After two months of writing about compliance I have had a few questions from managers along the lines of: Fine, but what should it cost?<\/p>\n
There is no single answer, but here is how I suggest you think about it. Split the cost in three: the work to implement the controls, the work to prove that they are in place and the work to handle the audit itself.<\/p>\n
In most companies I meet, the first part is surprisingly small compared to the other two. The money goes into collecting evidence, writing reports, meetings and consultants who translate between the auditors and the technicians. In other words, into proving rather than protecting.<\/p>\n
That is where automation makes the biggest difference. If the technical controls are monitored continuously, like I described in my previous post, a large part of the evidence comes for free. The audit becomes a review of a dashboard instead of weeks of preparation.<\/p>\n
So when you look at your compliance budget, ask your team how much of it goes into proving and how much into protecting. Then set a goal to move money from the first to the second.<\/p>\n
And remember that the most expensive compliance is the one you lose. Fines, lost customers and, as several companies learned last year, a breach that the audit didn\u00b4t catch.<\/p>\n
Spend on protection. Automate the proof.<\/p>\n","protected":false},"excerpt":{"rendered":"
After two months of writing about compliance I have had a few questions from managers along the lines of: Fine, but what should it cost? There is no single answer, but here is how I suggest you think about it. Split the cost in three: the work to implement the controls, the work to prove […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,79,70],"class_list":["post-1262","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-compliance","tag-cost"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1262","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1262"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1262\/revisions"}],"predecessor-version":[{"id":1306,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1262\/revisions\/1306"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}