Home » Data Protection » PCI and Compliance

Compliance? Whats That?

The majority of information security executives range from ambivalent (at best) to downright dismissive (at worst) about the intentions, effect and pertinence of security regulations.

One pwc analyst called these numbers scary, but which is scariest? Is it the comparatively low number of respondents who are in compliance? Or the shockingly high number of respondents who cop to not complying even though they know that they have to? Or could it be the startlingly low number who believe that the regulations apply to them? (The list of regulatory mandates in the survey was much longer, but other, lesser regulations showed a similar pattern.)

The third one may be the most telling. Just 11 percent of respondents said they needed to be in compliance with Californias SB 1386 law, which mandates that companies report breaches of personal data to consumers. In fact, any company that has even one customer in California must comply with the law, and surely more than 11 percent of U.S. respondents companies do business in our most populous state. Similarly, more than half said they didnt need to comply with Sarbanes-Oxley, and four out of 10 respondents in the health-care industry said that the Health Insurance Portability and Accountability Act (HIPAA) didnt apply to them, which seems impossible on the face of it.

But what do the numbers mean? Here are two theories, both of which probably play some role: One, the regs are confusing and difficult to comply with. This would explain the low numbers of respondents who believe they needed to comply with HIPAA or Gramm-Leach-Bliley regulations. They simply dont understand how the rules apply to them. Another theory is that the regulations have, in respondents minds anyway, few if any teeth. Companies dont fear any serious repercussions for not complying with the regulations, either because the mandates are too vague to really be enforced, or the regulatory agencies arent devoting resources to enforcement.

Supporting the lack of teeth theory is the fact that only a third of respondents reported having compliance testing in place, and only a quarter link their security organization to the compliance group.

Lobel offers a third factor: Theres just a lot of regs for these guys to deal with. Indeed, security mandates so far have targeted specific threats, industries or niches without a single overarching standard for companies to aim for. In this survey, we listed 43 regulations, all of which some respondents said they needed to comply with, and some respondents even added ones we didnt put on the list. Inevitably, companies will prioritize their limited resources to comply with those they consider most pressing and let others go.