We’ve been talking a lot about compliance lately. That’s because, as more businesses are moving to the cloud and storing internal and customer data there, the means to achieving compliance change significantly. But it’s not the approach to compliance that changes in the cloud, it’s the tooling, as we explained in our post How Does Compliance Differ In The Cloud Versus On-Premise? So as more businesses move to the cloud or operate hybrid environments, we want to help them become clear about what they need to do and, for the purpose of this post, when they need to do it.
Truth be told, most companies don’t prepare for compliance until the train is already on top of them, leaving them scrambling to put together the right processes and technologies. This approach is not only stressful, but is also prone to error. That web application firewall you bought? Turns out it wasn’t actually configured because your team was too busy moving on to the next requirement.
A lot of opportunities depend on you being compliant (sales being a big one), and companies need to start the process a lot sooner than they think to ensure that it doesn’t delay or derail big, company-changing, sales opportunities. While time, resources, and/or budget may be limiting factors for many companies, starting early can actually help you better prepare by using these often limited resources more efficiently.
Here are four reasons why you should start the compliance process now.
1. Waiting Until Compliance is a Necessity is Risky Business
It’s the classic ant-and-grasshopper story. The most difficult time to begin the compliance process is when it has become a business or legal stumbling block. Whether it’s your customers, partners, or the law necessitating it, you’ll find yourself scrambling to meet requirements if you’re not prepared ahead of time.
Recommended for You Webcast, August 30th: Real Time Website Personalization: Advanced Conversion Techniques
Planning and implementing compliance can take months or even years. So having to put off a big business deal or partnership, or to even continue doing business in lieu of not yet being compliant can be a big issue. A proactive, rather than reactive, approach will always put you in a stronger position.
2. You Need Time to Prepare Your Team
Chances are you don’t have a pre-assembled team that knows exactly what to do to meet HIPAA, PCI-DSS, SOX, and GLBA laws and regulations or ISO2700X, CoBIT, and ITIL frameworks. So you’ll need to plan for who should be involved and at what capacity to be sure you’re well staffed and can support the requirements of whichever laws, regulations, or frameworks are applicable to your business.
Roles typically involved in the compliance process include representatives from IT, security, HR, and finance, as well as a dedicated project manager and more, depending on what other departments handle and process data.
You want to give each of these team members plenty of time to prepare for what’s required of them when it comes to meeting compliance, because it’s likely that they already have a lot on their plates. If you don’t, ongoing business or operational tasks get disrupted or left behind, and time-sensitive compliance items may as well.
3. Old Technologies Cannot Meet the Needs of New Cloud Environments
Whether your organization runs in the cloud or (more realistically) with a hybrid on-prem/cloud environment, chances are the technology you used in the past to mark compliance checkboxes is no longer applicable. The network monitoring tool that worked perfectly on-premise five years ago? It won’t be able to account for the intricacies of a dynamic cloud environment.
That said, you’ll need plenty of time (months, typically) to research, test out, and then implement the right solutions to satisfy each checkbox. That’s everything from continuous security monitoring to password management and backups to firewalls.
4. Costs Can Escalate Without a Strategic Plan
Rushing to get everything done often means there is no time to determine a well-thought-out budget and plan. Even more, it means you’re strapped for time to find the most cost-effective option, so you may end up going with the more expensive one, thinking it does more. (Hint: That’s usually not the case.) Or you may opt for one or more point solutions that address some but not all of your needs, leaving gaps that will need to be explained to your auditors.
Costs can further escalate because you may have to hire more people, or bring in consultants, if your internal team isn’t prepared or doesn’t have bandwidth to get involved.
By starting the compliance process much earlier on, you leave time to strategically plan for the budget, team resources, technologies, processes, and so on. Then, when it comes time to putting it all into action, you can better stay within budget and properly evaluate the best option for each compliance requirement.
On the Road to Compliance
If you foresee your business needing compliance at some point down the road, commit to starting the process as soon as possible. Being compliant early on means shortening the sales cycle for opportunities, among many other business benefits that we explain in the post How Compliance in the Cloud Can Strengthen Your Business.
If you’re not sure how compliance applies to cloud environments (versus on-premise) have a look at the guidelines in our post, How Does Compliance Differ In The Cloud Versus On-Premise? Then sit down with your team to begin strategically planning for the people, processes, and technology components of your compliance requirements. If you’re in the midst of budgeting for 2017, now’s a great time to make sure compliance is a priority.
Why You Need to be Compliant Much Sooner Than You Think
Aucun commentaire:
Enregistrer un commentaire