The price of compliance by default
Jan 22nd, 2021 by Jesper Kråkhede
In my previous post I described the spreadsheet where all compliance requirements are mapped into one big set of rules. This post is about what it costs.
The first cost is time. Every new system needs to be checked against hundreds of rules. Projects that should take months take a year. The business waits, or worse, goes around IT and buys a cloud service with a credit card.
The second cost is people. Somebody needs to maintain the spreadsheet, interpret the rules, handle the exceptions and prepare the evidence for each audit. In larger companies that is a whole team, often made up of expensive consultants.
The third cost is the most expensive and the hardest to see. When everything is a requirement nothing is a priority. The real security work, protecting the admins, patching, monitoring, gets the same attention as row 347 about screensaver timeouts.
So for management: Ask how much your compliance programme costs per year, all in. Then ask how much of it actually reduces risk. You will probably find that a small part of the rules does most of the work.
Simplify. Focus on what matters and accept that some requirements can be met with a document instead of a technical project.
Compliance by default sounds cheap. It is the most expensive way there is.