IT executives and security professionals know that the web of laws, regulations and private-association rules that must be complied with gets wider, more complex and more costly every day.

When Nemertes Research asked participants in a new benchmark on security and information protection how much they spend on compliance, most participants were at a loss to come up with a number, because they had not created a separate budget line for compliance.

But there was widespread agreement that the amount is significant. Based on the Nemertes survey of more than 100 respondents, we've been able to pinpoint the cost areas associated with compliance and provide some benchmarks in terms of what other security executives are spending.

There are four levels when it comes to regulatory compliance:

* First, there are federal regulations. The most widely known is the far-reaching, broadly applicable Sarbanes-Oxley Act (SOX), which requires companies to certify the accuracy and accountability of financial data.

Other federal regulations include the Family Educational Rights and Privacy Act, the Health Insurance Portability and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act (GLBA). All require companies to protect confidential data (generally called nonpublic private information or NPPI). Beyond that, federal agencies, such as the Securities and Exchange Commission (SEC), set up regulations that apply to companies within their purview.

* Individual states have added their own requirements, chiefly for privacy. The best-known and farthest-reaching state law is the California Information Practice Act, also known as SB1386, requiring public disclosure of any loss or theft of NPPI, and which applies to any company with operations or customers in California. Given the size of the state, this law is as far-reaching as any federal regulation, except SOX.

* Private industrial organizations create a third tier of requirements: groups such as the Payment Card Industry (PCI) or National Association of Securities Dealers (NASD) define best practices and requirements for member companies.

* Companies operating outside the United States must also contend with a fourth level, the laws and regulations of other countries and bodies such as the European Union. Canada and Japan have significant information privacy laws, and the EU has a directive in the same vein.

Whitepapers

• Monitoring and Managing App Performance
• Monitoring and Managing VoIP
• SNMP Monitoring: One Critical Component to Network Management
• SNMP Monitoring: One Critical Component to Network Management
• A Modern Approach to On-Demand Email and Data Security
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange

View more NETWORK MANAGEMENT whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• Best Practices for Deploying WAN Optimization for Disaster Recovery
• Tips and Techniques for Remote Data Backup and Delivery
• WAN Optimization Landscape
• Lowering the Cost of Email Archives
• The High-Touch Remote Helpdesk: Centralized Support for the Decentralized Organization

View more NETWORK MANAGEMENT webcasts

Special Reports

• Network World Executive GUide: The Virtualization Equation
• Application Performance Management Executive Guide
• Executive Guide: Building a Service Oriented Architecture
• Optimizing Your Network Management Strategy for Today's Economy
• Get More From Your WAN
• Executive Guide: Storage Heats Up

View more NETWORK MANAGEMENT special reports