The Importance of Information Security Compliance

Since the high-profile failure of Enron, most large organizations are fully aware of the consequences of not complying with national and international laws and regulatory requirements. More recently, infosec has come under the radar of legislatures around the world, requiring organizations to comply with data security and privacy requirements. Hence being aware of what information security compliance is critical for every organization, large and small. 

Understanding the information security compliance definition is important for success. Compliance is all about meeting a set of rules or standards. Information security is concerned with protecting the confidentiality, integrity, and availability of information and technology assets within an organization. So, information security compliance means meeting rules or standards about the protection of data and information.

Governance, Risk, and Compliance (GRC)

Governance, Risk, and Compliance (GRC) are necessary functions within enterprises but businesses tend to structure and run them differently. For example, in some companies, GRC operates as three separate, siloed functions. Other companies have a GRC function that includes GRC specialists if not GRC certified professionals. 

Even when GRC operates as a combined organization, cyber security – another risk function – tends to operate separately. One of the reasons for that is because GRC functions are viewed as business functions while cyber security is viewed as more of an IT (technology-oriented) function. However, as any cyber security incident demonstrates, the scope of risk fallout tends to impact more than one function simultaneously.

The scale of the compliance issue

To get an idea of the scale of the information security regulations, there are hundreds of laws at federal and state levels that exist to protect the personal data of individuals in the USA. The UK has over 16 items of legislation that have to be complied with. No matter what size your organization is, you need to be fully aware of your legal requirements for information security and plan for compliance.

Here is an example of just some of the most common U.S. information security compliance standards, each relating to one or more different industry sectors:

Sarbanes-Oxley Act (SOX):

Compliance with the Sarbanes-Oxley Act requires financial records to be retained for seven years. It is required for all U.S. company boards, management personnel, and accounting firms. This legislation aimed to prevent another scandal like the Enron incident, where fraudulent bookkeeping led to a series of events resulting in the bankruptcy of the major this major U.S. energy, commodities, and services company and the dissolution of their auditors, Arthur Andersen LLP, which had been one of the largest auditing and accounting companies in the world.

GDPR:

The General Data Protection Regulation, or GDPR, aims to protect citizens in the European Union (EU) from data breaches. The GDPR applies to all companies processing personal data for people residing in the EU, even if that company is not physically located or based in the EU. This is a good example of how information security compliance may be required for legislation that arose in another jurisdiction.

FISMA:

The Federal Information Security Management Act of 2002 considers information security to be a matter of national security for all U.S. federal agencies. As part of the bill, all federal agencies are required to develop data protection methods.

HIPAA:

An acronym for the Health Insurance Portability and Accountability Act. This bill establishes several regulations about maintaining the security of healthcare patients records. All companies that handle healthcare data must comply with the HIPAA regulations when handling this data.

PCI-DSS:

The Payment Card Industry Data Security Standard is a set of regulations aimed at reducing fraud, primarily through protecting customer credit card information. PCI-DSS security and compliance is required for all companies handling this information.

Information security compliance standards

ISO/IEC 27001, the international standard for an information security management system (ISMS), is the most commonly used IT security compliance standard. It sets out a best practice approach for providing appropriate security for data and information. This information security compliance standard can support all other IT-related regulations by providing independent structured guidance for an ISMS. This encourages a risk-based approach to securing and maintaining the confidentiality, integrity and availability of data and information. The standard also provides an overarching control environment within which the specific controls of the IT systems and information technology rules and regulations can operate effectively.

How IT Governance can help you

Expert individuals who have held leadership CISO roles and have a wealth of industry experience.

Skilled at ensuring your organization is prepared to deal with data breaches and incidents.

Ability to manage and communicate with regulators for all data privacy and information security requests on your behalf.

Experienced practitioners who can offer cyber security training as part of the service.