by Jesper Kråkhede, Sweden
Posted in Business, Security Architecture on Jan 22nd, 2021
Following my previous post, a word to management about compliance. In many companies compliance has become a game of doing as little as possible. The auditor comes once a year, the team prepares the evidence, the findings are negotiated down to something manageable and everybody is happy until next year. I understand it. Compliance costs […]
Posted in Business, Security Architecture on Jan 22nd, 2021
In my previous post I described the spreadsheet where all compliance requirements are mapped into one big set of rules. This post is about what it costs. The first cost is time. Every new system needs to be checked against hundreds of rules. Projects that should take months take a year. The business waits, or […]
Posted in Security Architecture, Technology on Jan 3rd, 2021
A new year and a new theme. This year I want to spend some time on compliance, because it is one of the most misunderstood parts of security. Let me start with a statement that usually upsets someone: Compliance is never good security. At best it is a baseline. Every standard and regulation is written […]