Generating Competitive Advantage Through Compliance

All too often security compliance is regarded as a series of hurdles the business needs to jump through in order to achieve accreditation. It can tend to be regarded as red tape and a barrier to getting things done.

But changing the mindset of the executive body so that regulations are regarded as helping rather than hindering ambitions can pave the way for the business to become more efficient and more competitive in the marketplace.

From a security perspective, cyber risk is the predominant factor in the decision-making process and this seems to contradict the primary objectives of the board, which are to save money, save it faster, make money, make it faster and manage risks that threaten those objectives.

Yet the two need not be conflicting if controls are applied in such a way that they allow the business to achieve those goals, rather than acting as an impediment. 

A good analogy here is Formula 1 racing. Racing driver, Mario Andretti, famously said: “It’s amazing how many drivers, even at the Formula 1 level, think that the brakes are for slowing the car down”. In actual fact, those brakes are there to provide the driver with the control to enter and exit a corner and in so doing, optimise the performance of the car and the time taken to complete the circuit. Similarly, compliance can enable processes and procedures to be better understood. 

Streamlined By Compliance

For example, there may well be changes or improvements that the business wants to make to software or systems to boost its competitiveness and it’s at this point risk and compliance can become an obstacle. However, if the business puts compliance first and implements the necessary processes, expectations can be met quicker. By putting processes X, Y and Z through the risk management lens, it becomes possible to see what elements are or are not applicable and what could confer competitive advantage versus what could constitute a block.

Let’s use the hypothetical example of a US company selling software to a non-aligned market such as Russia or China. That team would face export controls on its software. By identifying where those barriers to export are at the earliest stages in the process, the business can get the product into production more quickly without the need to retroactively engineer further down the line which would cause delays. The process is effectively streamlined in accordance with compliance requirements.

To get to this position, the board needs to actively engage with its responsibilities from a regulatory compliance perspective. Of course, compliance with cyber security regulations and standards is not optional – it is a legal requirement that protects the company from fines and reputational damage – but complying with regulations versus utilising them are two very different things.

To establish where the business is in terms of its compliance maturity, it’s necessary to ask some searching questions.

Questions To Consider

First and foremost, what role does the board play in overseeing the company’s cyber risk management and compliance strategy? Is it purely passive or does it seek to lead? Does the board seek to stay informed about the latest cyber threats and trends or is it simply reactive? How does the board evaluate the effectiveness of the company’s cyber risk and compliance management, and applied security measures? What measures are in place to ensure that the company complies with relevant cyber security regulations and standards? And how would the board describe the company’s approach to ensuring that there is an appropriate incident response capability?

The answer to these questions should ideally see the board taking an active role in the security management of the company.

Effective leadership in this regard will help the business stay abreast of relevant regulations and standards and ensure that compliance efforts are thorough and proactive. This is vital because the regulatory landscape for cyber security is complex and ever-changing, so the board needs to be aware of its legal and regulatory requirements on an ongoing basis.

Compliance with Digital Operational Resilience Act (DORA) provides a good example as its relatively recent. Being able to demonstrate compliance with the standard is one thing but being able to articulate that in terms of the controls and risk management processes that are in place can be a strong business enabler. From a marketing point of view, compliance with DORA marks the business out, signifying it has met stringent demands. This then allows the business to win new customers or renegotiate contracts from a stronger position, thereby bolstering its competitiveness. 

Personal Accountability

The general direction of travel with respect to regulations is that the board is increasingly being held accountable. Revisions to disclosure requirements such as the Securities and Exchange Commission Form 8K, NIS2 on the continent and possibly the Cyber Security and Resilience Bill here in the UK, all require senior management to be able to demonstrate oversight of risk management. A failure to do so could result in those individuals being held personally responsible, making it even more pressing this issue is addressed.

The reality is that the board must now get to grips with compliance and should regard it as another critical aspect under its remit.

But this needn’t equate to an increase in workload. Senior executives at board level seldom hold cybersecurity experience so it makes sense to put in place a risk management and compliance board to keep them informed. The committee should include members with diverse expertise in finance, operations, legal, compliance, and strategic planning and should seek to evaluate, mitigate, and monitor various risks, reporting back to and informing the board. In addition to providing compliance oversight, such a committee can also identify risk, review policy, evaluate internal controls and ensure reporting mechanisms are effective.

Aided by these personnel, the board can then begin to use compliance as an enabler that that informs the decision-making process and strategically allows the business to position itself to capitalise upon market opportunities.

James Eason is GRC CRA Practice Lead at Integrity360

Image: Ideogram

You Might Also Read: 

Six Steps On The Road To NIS2 Compliance:


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Safeguarding Your Business: 10 Best Practices For Mobile Device Safety
Social Media Algorithms & Their Effects »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Willis Towers Watson

Willis Towers Watson

Willis Towers Watson is a global risk management, insurance brokerage and advisory company. Services offered include Cyber Risks insurance.

Singapore Cybersecurity Consortium

Singapore Cybersecurity Consortium

Singapore Cybersecurity Consortium was created to encourage use-inspired research, training and technology awareness in cybersecurity.

CERT-UG/CC

CERT-UG/CC

CERT-UG/CC is the national Computer Emergency Response Team for Uganda, operating under the National Information Technology Authority (NITA-U)

VisionWare

VisionWare

VisionWare provide consulting services and solutions in areas covering both physical and digital security.

Duo Security

Duo Security

Duo combines security expertise with a user-centered philosophy to provide two-factor authentication, endpoint remediation and secure single sign-on tools.

Privacy Analytics

Privacy Analytics

Privacy Analytics enables healthcare organizations to unleash the value of sensitive data for secondary purposes without compromising personal health information.

Idaho National Laboratory (INL)

Idaho National Laboratory (INL)

INL is an applied engineering laboratory dedicated to supporting the US Dept of Energy's missions in energy research, nuclear science and national defense including critical infrastructure protection.

Industrial Cybersecurity Center (CCI)

Industrial Cybersecurity Center (CCI)

CCI is the first center of its kind that comes from industry without subsidies, independent and non-profit, to promote and contribute to the improvement of Industrial Cybersecurity.

Secberus

Secberus

SECBERUS creates cloud security technology to help organizations stay secure & compliant in the public cloud.

Internet Crime Complaint Center (IC3)

Internet Crime Complaint Center (IC3)

The Internet Crime Complaint Center provide the public with a reporting mechanism to submit information to the FBI concerning suspected Internet-facilitated criminal activity.

Guardio

Guardio

Guardio develop tools and products to combat modern web and browser threats.

tru.ID

tru.ID

We’re tru.ID, and we're reimagining mobile authentication, one API at a time.

Dawgen Global

Dawgen Global

Dawgen Global is an integrated multidisciplinary professional service firm in the Caribbean Region providing a range of services including Risk Management and Information Systems Assurance.

Kivera

Kivera

Kivera enforces your organisation governance and security policies across cloud deployments preventing misconfigurations turning into attack vectors.

Mercury Systems

Mercury Systems

Mercury Systems is the leader in making trusted, secure mission-critical technologies profoundly more accessible to aerospace and defense.

Baidam Solutions

Baidam Solutions

Baidam Solutions is a 100% Australian owned and operated First Nations information technology business.