Security and Privacy Compliance

Accenture outlines the critical factors organizations must consider to meet new security regulations. We lay out the guidelines to design an environment that not only complies these new rules, but provides enhanced security and business capabilities.

Government or regulatory agencies continue to issue a steady stream of market, industry and situation-specific regulations. Affected organizations—both public and private—struggle to keep up. While the nuances of their security models are organization-specific, our experience indicates that leading enterprises share a similar approach to building secure IT environments that meet the government regulations.

Some security observers estimate that an average of 450 new worms, viruses and Trojan horses are created and released into cyberspace each month. And the intrusions grow more pernicious—the estimated global business loss from just two of last year's more famous events, the SoBig and Blaster attacks, was $35 billion.

While the nuances of their security models are organization-specific, our experience indicates that leading enterprises share generally similar approaches. First, they have a deep understanding of both the relevant security and privacy regulations in their industries, and of the business needs of their customers and partners, as well as a commitment to develop clear policies, standards and strategies around these requirements.

Second, they understand that effective policies depend on robust controls (technical and non-technical) and security architecture, and they design and implement controls and architecture accordingly. Third, they support the viability of their compliance programs with an effective governance model, which establishes clear decision-making, monitoring, audit and enforcement mechanisms, fully cognizant of cultural realities within the organization. Lastly, they calculate for the inherently dynamic nature of security and privacy compliance, and cultivate senior executive and even board-level commitment, with clear plans for change leadership.

What about organizations that have implemented only parts of a strategic security and privacy compliance model, or enterprises that seek to catch up with current-state regulatory demands? Accenture's experience shows that many may have to recognize that their existing compliance resources may be overmatched by a comprehensive, one-at-a-time change effort. Such organizations may eventually find that even when they have become compliant, they might not be secure. These enterprises may then be moved to find specialist partners adept at both designing and implementing compliance transformation. The focus of emphasis will of course vary by organizational need, but the general end-to-end approach will be consistent.