World View

Oui, Virginia, There Is a Hell

Wherein our intrepid American CISO sits before a European audit committee?

By Paul Raines

the value of following an international standard. This was not the United States, they assured me.

Europe, they huffed with a superior air, follows international best practices in security. What was unsaid

but implied was that their American cousins hadn't quite risen to this level of sophistication. I smiled

politely and endured the lecture. The best that could be said was that the more time they spent

pontificating, the less time they had to nitpick over my report.

Granted, this interaction was partly about who had the biggest uvulas, so to speak. But it also

illustrated a fundamental difference in the way audits are conducted on both continents. In the United

States, audits are about ensuring that sufficient controls are in place to mitigate risks. Thus, the audit

findings tend to emphasize lapses in application and network security. In Europe, audits tend to focus

on following a predefined process, being transparent in the actions taken, precisely defining policies

and procedures, and adhering to international standards.

Part of the difference lies in the fact that ISO standards enjoy a wider adoption rate in Europe. It

might also be cultural in that Europeans have spent generations developing technical standards

the railroad and telegraphs come to mindwhile in America, standards tend to evolve from

whoever wins the struggle of market domination.

Given these differences in culture, is it any wonder that IT audits in America and Europe differ so

widely? Americans and Europeans really don't speak the same language. C'est la vie dans la grande

ville.

Paul Raines is CISO of a nonprofit group in The Hague, Netherlands. Send feedback to Senior Editor

Sarah D. Scalet at sscalet@cxo.com.

Other stories by Paul Raines

• Email
• Print
• Comments
• Digg This
• SlashDot