The goal sounds straightforward, but one of the primary challenges of good governance and risk management is the fact that many companies store information about corporate policy, risk, and compliance in literally hundreds, if not thousands, of documents and spreadsheets. These ineffective practices worsen when multiple teams—security, network, applications, internal audit—each review and report on identical systems and controls.
Clearly, IT security and compliance management has to be simplified. For example, consider the cost of managing multiple password policies throughout a company, with differing edicts coming from internal security teams and external regulations. Melding password policies—such as length and reset time periods—into a single policy that meets the requirements for each will save costs and reduce complexity. "By governing policies in this way, companies don't have to reinvent password guidelines every time, and the efforts can be managed as a best practice throughout the entire enterprise," says Dennis Chesley, principal at consultancy PricewaterhouseCoopers.
Not every business is equally motivated, of course, and the maturity of an organization’s GRC efforts run the gamut, says Christopher Hoff, chief security architect for IT services and software provider, Unisys "Those that are not heavily regulated, or have a high tolerance to risk, may not be very far along in any risk management or governance efforts.
Organizations with minimal intellectual property, or information about customers, or that just want to make certain their systems are adequately secure and available, often have elemental security procedures in place. "These are the companies that make reasonable efforts to scan their networks and applications for vulnerabilities and then patch at-risk systems—and have security applications deployed to varying degrees," Hoff says.
On the other hand, those companies that are high-risk targets, and also must comply with multiple regulations, such as a publicly traded health-care provider, are striving to adopt a GRC approach to security, compliance, and privacy. They want to get better at adopting their security and regulatory compliance mitigating controls, and capturing the information necessary to streamline controls, into many parts of the company," says Chesley.
"The problem with a straightforward threat and vulnerability focus is that businesses aren't always able to focus on the threats and risks that matter the most. They don't have transparency to see which vulnerabilities could lead to the greatest negative business impact," says Hoff. Essentially, they'll simply conduct a vulnerability assessment and patch the most critically ranked software vulnerabilities first. "But what if you have intermediate level vulnerabilities on your database servers and the critical risks are on your print servers? If you have good risk-management controls in place, and have properly classified your infrastructure, you're going to patch those intermediate vulnerabilities first," says Hoff.
PricewaterHouseCooper’s Chesley works with clients to define their risk-tolerance and their alignment with the business. "Typically, there are multiple groups reporting on the same controls, and their results often don’t reconcile," he says.
But all of the blame can’t be placed on businesses. The number of controls a large corporation must manage can be extremely high, and they often extend to every technology deployed. These include identity and access management, security-event managers, and disaster recovery and records-management systems. "There’s hardly an area of IT that GRC efforts don’t touch," says Ptak.
Unisys's Hoff says it's also crucial to identify what aspects of the infrastructure are most important from a business
perspective. That is, what databases, servers, and network segments manage and hold regulated or key business information. "The challenge is doing that not once, or once in awhile, but on a continuous basis," he says.
Many companies are good at some aspects of risk management, but aren’t always consistent throughout the business. "It's important to align risk management with business objectives to enable rationalized decision-making processes," says Hoff.
IT vendors—including suppliers of network and system management software, enterprise resource planning providers, and even dedicated IT GRC vendors—offer some good solutions. Many are developing a broad range of GRC management tools to help CIOs model their controls and procedures, associate those controls with relevant policies and regulations, and enforce compliance across the organization. In this way, companies can improve their visibility into compliance risks and gather the supporting evidence they need to demonstrate compliance with policies and external regulations during audits.
These solutions help compliance managers proactively analyze and report rapidly on multiple regulations and policies, explains analyst Ptak. Also, comprehensive analyses help managers quickly understand their risk profiles, so they can streamline their governance efforts and cut redundant processes.