Have you curled up with any good IT compliance books lately?
Yeah, we haven鈥檛 either 鈥� except for 探花大神ian Kate Lake who has been digging into The IT Manager鈥檚 Guide to Data Compliance Hygiene. Understandably, most IT managers avoid dealing with compliance until deadlines are looming.
Maybe it鈥檚 because the subject matter is about as dry as one of those bird seed-looking crackers. You know, the kind you can only buy at organic and specialty grocery stores.
If you鈥檙e not into bird food, or you鈥檝e been too busy troubleshooting tickets, monitoring security threats, and onboarding new employees to look into compliance protocols, this article is for you. We鈥檒l discuss the four most common surprises you will likely encounter when spearheading the IT compliance audit process for the first time.
Whether you鈥檙e prepping for SOC 2, PCI DSS, or another security standard, use the following information to mentally prepare for what鈥檚 to come.
4 Challenges to Staying IT Security Compliant 24/7
Data compliance necessitates following several overlapping guidelines ranging from disclosing how collected data is used to restricting access to sensitive information to fixing security vulnerabilities to ensuring the accuracy of information.
But the real challenge lies in meeting these obligations in the context of having to comply with multiple regulations at once! Let’s discuss some common challenges you may face when implementing compliance regulations and how to confront them:
1. Long Review Periods
Timing 鈥� it鈥檚 one of the most nerve-wracking aspects of data compliance audits. Take SOC 2 Type II for example.
It involves a 2 to 3 month remediation period followed by a 3, 6, or 12 month observation period. The length of the observation period is up to your organization.
During this period, auditors can conduct interviews with stakeholders, request evidence of controls, and assess compliance at random. Unfortunately, this means they may happen to choose a nontypical day with a high number of control failures.
In such instances, it鈥檚 your responsibility to explain what鈥檚 going on. For example, you might present the auditor with a list of your devices and a list of items that aren鈥檛 yet compliant. You might then say something like: we have tickets open on 10 devices and a handful of devices that were recently deployed for new hires yesterday.
Consistent and clear communication is essential.
2. Unclear Control Guidelines
The next frustrating roadblock you may encounter are ambiguous control guidelines. Regulatory agencies provide little guidance toward selecting and defining controls.
While certain guidelines leave no room for misinterpretation (e.g., employ multi-factor authentication), others provide significant leeway on the best course of action for achieving results.
Even the is a bit vague when it comes to providing instructions for SOC 2. With dozens of controls spanning multiple security avenues, it鈥檚 easy to get lost in the weeds. Audit workflow software is one way to expedite the process.
In addition, the 探花大神 open directory platform provides recommended policies that you can turn on with the flip of a switch. The platform鈥檚 customization makes it easy to automate the most common controls and hygiene standards you need to achieve compliance.
3. Competing Regulatory Requirements
Sometimes the problem isn鈥檛 鈥渘ot knowing what to do,鈥� but navigating seemingly conflicting standards and regulations. Just ask Idan Mashaal, 探花大神 senior EMEA solution consultant and Israel country manager.
During his time as employee no. 5 at Plus500, Idan confronted many unexpected challenges while managing requirements from multiple countries including the UK (FCA), Australia (ASIC), Cyprus (CYSEC), and more.
鈥淚n one particular instance, the GDPR said we needed to allow users to be forgotten, but the financial regulations said I needed to store the information for seven years,鈥� he said. 鈥淪o, we were in a debate between the law and the European Union, which dictated a 50 million euro fine, and the license that will allow me to make money.鈥�
In addition, the GDPR only applies to the EU, which begs the question: Should the organization apply the regulatory standard universally (at the expense of global business) or should it create a system for separating businesses outside of the EU?
Ultimately, Idan realized 鈥渢he right to be forgotten鈥� isn鈥檛 synonymous with the 鈥渞ight to be deleted.鈥� The solution was to 鈥渇orget鈥� who the user was as a person while still keeping the data intact. This is just one example of the many types of unexpected situations you may encounter when becoming compliant.
4. Balancing Usability and Regulatory Compliance
Balancing data compliance controls with workflow efficiency isn鈥檛 always easy. In some cases, regulations present unrealistic parameters that defeat their purpose. For example, say one regulation requires the enforcement of a lock screen mechanism every 10 minutes.
But your research and development (R&D) department says that any locking mechanism under 15 minutes interferes with their daily processes. This is just one of many small, but significant challenges that can occur when balancing controls with user experience.
Admins are often faced with answering a difficult question: Do we run the business most effectively or most securely? This unintentional catch-22 can make it even more difficult to find effective solutions that achieve both ends.
As an IT manager, you can and are expected to solve problems in innovative ways. You can ideate creative workarounds as you build toward compliance so long as you can:
a) provide the reason behind the control failure and
b) provide documentation of proposed remediation.
In such instances, your auditor will check back in 30 days. As long as you have followed through with your remediation plans, and demonstrated intelligent thought in following guidelines, you鈥檙e in good shape.
Remember: auditors aren鈥檛 pencil-pushing enemies analyzing rows of data for breakfast!
They are supportive professional partners who possess valuable insights to help you succeed.
The more transparent you are from the beginning, the better equipped they are to propose unique solutions to your problems. Work with your auditor to seek solutions to whatever makes it tough to follow a particular regulation, rather than assuming nothing can be done.
Simplify Security Compliance with 探花大神
If you鈥檙e ready to streamline IT security compliance planning, we recommend consolidating your stack as much as possible. Fewer tools means less time spent sifting through copious amounts of compliance data and less risk of human error when cobbling it together.
闯耻尘辫颁濒辞耻诲鈥檚 Directory Insights feature allows admins to access a variety of data points that can be quickly filtered for internal and external auditing purposes. Admins can also enjoy Users to Devices, Users to Servers, and Users to Directories advanced reporting options.
Ready to get compliant? Our IT Compliance Quickstart Guide will walk you through how to prepare for an audit and how to boost your IT security baseline.
