* Who is that new company exec asking about the security of your network?
There’s a new company executive in the hallway who’s sniffing around your network. He has been asking the business unit managers probing questions such as who has access to the network, what information is on there, how that is protected and what controls IT has in place should the network be compromised.
Welcome to the world of regulatory compliance and compliance officers.
If you work in a regulated industry, you won’t need me to tell you the pressure you’re under to meet the provisions the Health Insurance Portability and Accountability Act, Sarbanes-Oxley, and Basel II in the financial sector. As part of the effort to comply with these regulations, organizations are hiring compliance officers into the executive suite.
Risk management experts believe that IT executives should be the compliance officers’ strongest allies because IT can provide the wealth of information that compliance officers need, but the two camps rarely communicate. Pierre Noel, vice president of regulation and operational affairs at Consul Risk Management, meets with IT execs and compliance officers every day and says compliance execs often don’t understand the impact of regulation on IT. Since these officers usually come from the audit, finance or risk management side of the house, they often limit their information gathering to business unit heads and tend to overlook IT, says Noel.
In most cases, IT holds the key to the information that compliance officers need. Such information includes who has access to what, whether certain applications have been compromised or subject to near misses, and what controls and policies are in place to safeguard risk. Consul sells software that pulls together and examines security logs from IT resources to identify violations – information that compliance officers need to know, but Noel is spending much of his time educating both compliance officers and IT execs of the importance of working together.
The lack of understanding is affecting IT in other ways too. Noel says: “IT managers tell me that they understand the need for risk management but they have no money because the budget comes from the risk manager.” Hmmm, a tricky problem.
Noel has also found that IT security execs often view compliance officers with suspicion. “IT security people don’t like to be monitored or measure. They ask ‘Why are you looking at what I’m doing?’,” Noel explains.
Noel suggests mutual education. IT execs should try to familiarize themselves with the regulations that govern their industry and should set up meetings with their compliance counterparts to let them know that IT can help make their jobs a whole lot easier.
