Governance and regulatory compliance
Organisations face an ever increasing list of statutory, regulatory, contractual and legal compliance obligations.
Compliance issues should concern the board, not just the IT department, and include issues of Data Governance, the EU GDPR (General Data protection Act), Operational Risk, Information Security, Best Practice and Basel II/III.
Common compliance requirements
In today's complex regulatory environment, organisations must:
- Grapple with the complexities, costs and overlaps of governance requirements (Combined Code, Turnbull, Sarbanes Oxley, Basel II, etc.);
- Comply with a wide range of information-related regulation, from the Data Protection Act to GLBA, HIPAA, PIPEDA and the Computer Misuse Act; and
- Deal with an increasing exposure to rapidly mutating, sophisticated threats to their information and information assets, which exploit a diversity of technical vulnerabilities in IT systems as well as loopholes in procedures and the behavioural characteristics of employees.
The table below lists the most common compliance regulations that organisations have to comply with, what security areas they cover and the compliance requirements:
| Regulations |
Who Needs to Comply |
Security Areas Covered |
Compliance Requirements |
| HIPAA |
US healthcare organisations and partners |
Creating, storing and transmitting electronic protected health information |
All major "Best Practice Security" areas |
| Sarbanes Oxley (SOX) & Acctg Standards COSO, COBIT®, SAS |
US public companies |
Defined to secure the public against corporate fraud and misrepresentation |
All major "Best Practice Security" areas |
PCI DSS
(Also Covered by Breach Laws) |
Merchants who take credit cards |
Privacy of Customer Financial Data |
Varies by size of merchant, requires Best Practices plus 3rd Party Quality Risk Assessments |
|
GLBA - Federal Law 106 - 102 FDIC/FFIEC Guidelines FACT U.S. Patriot Act (2001)
|
US financial institutions
|
AFinancial Services Act - Privacy of Personal Info. Safety of Internet based Products & Services Fair and Accurate Credit Transactions Anti – Terrorism |
"Best Practices", Security Two-Factor Authentication, ensure Accuracy & Safety Identity Verification |
|
Breach Laws in 31 US States Including California SB 1386
|
Any company storing, or accessing private consumer data
|
Consumer Privacy - Security Breach Acts |
All major "Best Practices Security" areas |
|
EU General Data Protection Regulation (GDPR) and Privacy Regulations
|
Any EU organisation holding personal data
|
Personal data |
All major best practice areas |
PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) has been devised to increase security around card transactions. Acknowledged the world over, compliance to the PCI Standard is mandatory for card-accepting organisations. The standard requires merchants to demonstrate a secure IT network that protects card holder data, maintain a vulnerability management programme, implement access control measures and regularly test their networks.
Find out more information on our bespoke PCI DSS page.
Basel Accords (Basel II & III)
Basel III is the latest instalment of the Basel Accords, which set out a regulatory standard for the financial industry. Basel III has been developed in response to the global financial crisis which started in 2008; it is expected to be introduced from 2013 to 2018. Its predecessor, Basel II, was created to ensure that banks put aside enough capital to safeguard against operational, financial and economic risks. In essence Basel II stated that the greater risk a bank exposed itself to, the greater capital it should hold.
Compliance & Best Practice
ISO 27001, ITIL® and COBIT are all potentially part of a best-practice approach to regulatory and corporate governance compliance.
The challenge for many organisations is to establish a coordinated, integrated framework that draws on all three of these standards. The Joint Framework, combining COBIT and ITIL, is a good starting place.
ISO 27001, the international standard for an information security management system (ISMS), also sets out a best practice approach. This standard links to all the IT-related regulations and provides completely independent structured guidance for a risk-based approach to securing the confidentiality, availability and integrity of corporate information. It also provides the general control environment within which the specific controls of an internal control structure can most effectively operate.
Find out more about ISO27001 and how it can help with compliance on our designated ISO 27001 page.
Sarbanes Oxley Act
From 2002, the Sarbanes-Oxley Act (SOX) enforces US organisations to demonstrate corporate governance compliance. SOX requires management to certify the company’s financial reports, and both management and an independent accountant are required to certify the organisation’s internal controls. This has a huge dependency on the IT infrastructure and IT systems.