David Lacey's IT Security Blog

This Wednesday I'm delivering a keynote address at a CIPFA/ISACA Conference in Birmingham on Emerging Compliance Requirements. The subject of my talk is "The Global Compliance Environment", a subject that's already engraved on many security practitioners' hearts as international events, initiatives and interests generate wave after wave of new legislative and regulatory compliance requirements. Can we expect to see an end to the mounting compliance burden? Not in my view. In fact it's more likely that the demands will get broader, deeper and tougher, as governments, regulators and large organizations follow suit in adopting and imposing standards and best practices across countries, industry sectors and supply chains.

Few organisations have had sufficient foresight, time and resource to adopt a strategic approach to compliance. But quick fixes to ad hoc demands are the most expensive solutions. Organisations need to spend time designing smarter compliance systems, to reduce the time and effort required to identify requirements, assign responsibilities, train staff, gather data, conduct audits, assess findings and track remedial work. Keeping your head in the sand might delay the pain in the short term but the cost of compliance will catch up with everyone in the end.