So Much Compliance…So Little Time (And People!)

In my seven years at Coalfire I've had the pleasure of working with dedicated compliance professionals at organizations of all shapes and sizes. Over time, I've seen the pressure on these folks increase tenfold as the stream of new compliance obligations jumps its banks and becomes a flood. The pressure increases as their organizations try to enter new markets but find they’re thwarted because of new compliance requirements. I hear the same thing over and over – they have too much to do and not enough people to do it.

Let’s look at some facts. Coalfire recently conducted research with our partner Omdia that confirmed exactly what I have been hearing from customers about the imbalance between requirements and resources. Compliance obligations eat up 40% or more of IT budgets. The majority of organizations (58%) view compliance as a barrier to entry into new markets. And 67% of them indicate they're struggling with internal collaboration when it comes to compliance. This is all happening during an extreme shortage of skilled cybersecurity professionals – and as an employer of these same professionals ourselves, we know just how significant the shortage is!

It’s crystal clear that the current approach to compliance is unsustainable. Organizations are spending upwards of 10,000 hours a year (for larger organizations) to satisfy just a single compliance requirement, and that’s no longer defensible. Managing compliance is more complicated, disruptive, and time-consuming than it needs to be, and it distracts organizations from activities that add value to their business.

The current compliance landscape

Part of the problem is a scarcity of right-sized solutions available for managing programs that focus on compliance. Organizations typically fall into three camps: those with no tools who are looking for solutions; those who have built home-grown tools that aren’t scalable and eventually crack under the weight of increasing and complex compliance requirements; and those who have implemented, or are implementing, a governance, risk and compliance (GRC) or integrated risk management (IRM) solution.

While comprehensive GRC and IRM solutions exist, both use a broader approach that goes well beyond the needs of compliance. Each can be way too complex, expensive to set up, complicated to learn and use, and require a significant investment in time and money, plus the intimate knowledge of each compliance area, to successfully implement. Even when they’re up and running, they under-serve the compliance team because they lack meaningful guidance (and certainly none from the perspective of expert assessors) for running that very specific program.

Limitations of existing solutions

For organizations that have successfully implemented a GRC solution, that’s only one consideration. They may now have a tool that helps store and manage a myriad of asset inventories, evidence, policies, and procedures required to pass a compliance assessment. But several key questions remain:

• Does the solution inform them of their compliance obligations and proactively guide the program throughout the year?
• Does it evolve as existing regulations change or as new regulations emerge?
• Can it provide the structure needed to reduce chaos caused by the crunch of point-in-time assessments?
• Does the tool offer automated evidence collection and integrate with existing tools and workflow applications?
• Does it provide expert guidance based on years of compliance assessment expertise that shows what is really required for a given regulation or framework?

The answer to these questions in most cases is "no".

Organizations with home-grown solutions for managing compliance face many of the same challenges associated with GRC implementations. One is the lack of concrete guidance for their compliance program. It is also noteworthy that any guidance is only as good as the expertise of the team members who created the tool. As compliance requirements change and obligations increase, home-grown solutions can’t keep up with the dynamic nature of the regulations. Add to that a lack of scalability to support workflow, communication, messaging, dashboarding, and data transparency needs, and the deficiencies quickly become evident for most in-house solutions.

Is there a better approach?

Coalfire leveraged and extended a technology platform that we’ve used for years to enable assessments and created a compliance management solution designed to address the issues previously discussed. We’ve observed that many (maybe even most) organizations don’t actually need a complex and costly GRC/IRM solution. We believe that companies are better served with a scalable, easy-to-use solution that’s quickly implemented and purpose-built for managing a compliance program throughout the year, not just during point-in-time assessments.

What else do organizations need for proactive compliance management? A dashboard to show them what work needs to be performed, by whom, and by when. They need alerts for when tasks are due or when compliance requirements are being missed, putting their compliance posture at risk. How about expert assessor knowledge that’s built into the solution and tailored to their compliance program? This ensures that they're doing what they need to, when they need to, and avoiding redundancies caused by overlapping compliance obligations.

A solution that serves as a ‘compliance coach’ can help organizations avoid surprises when they’re midway through an assessment. We recommend a solution that helps teams meet compliance obligations but more importantly, helps them understand why specific activities are needed, why certain evidence is requested, and what form that evidence must take to satisfy the audit team during assessment time. Like a coach who can optimize a batter's swing to deliver the most power to the ball with the least effort, we’re creating solutions that help optimize compliance activities, ensuring that organizations get the most out of their scarce resources – time and people.