Technology Compliance: Supporting, Assessing & Monitoring

 

A Framework for Technology Compliance

 

Key takeaways:

---

Technology allows businesses to do more—but it also requires them to comply with laws and regulations on how it’s used. Technology compliance can be a complex and intimidating topic, but a focused approach helps organizational leaders stay on top of what they need to know and do. Some best practices we’ve identified include:

 

• Creating or evaluating general policies
• Understanding which laws and regulations apply to your business
• Aligning policies with the IT environment and the organizational culture
• Assigning accountability
• Documenting compliance policies in written form
• Consistent monitoring and testing
• Reviewing compliance policies and effectiveness annually

 

Technology requires businesses to comply with laws and standards regarding privacy, the use of data, and much more. While some industries—such as healthcare and finance—have more specific compliance requirements, every organization using technology to collect and analyze data or interact with users must comply with a minimum set of regulations and best practices regarding data use, storage, sharing, destruction and more.

 

For example, an internal acceptable use policy may involve rules related to intellectual property and access to proprietary information. This will affect how a business engages with employees, contractors and potential employees or freelancers.

 

Creating compliance policies and ensuring technologies are aligned is a group effort requiring input from IT leaders, legal, HR and other departments. Even seemingly simple compliance issues, such as password requirements, can get pretty complicated—which is why many businesses put off addressing them. The process can vary, but some best practices include the following.

 

 

• Assess general policies. Every business should have a user acceptance policy, password and data sharing and destruction policy. These should be in place no matter the type of organization.

 

• Identify applicable laws and regulations. Some of these include the General Data Protection Regulation (GDPR), relating to the processing of personal data of individuals in the European Economic Area; System and Organization Controls (SOC), standards for internal controls over financial reporting (SOC 1) and for how service organizations manage customer data (SOC 2); and the Health Insurance Portability and Accountability Act (HIPAA), U.S. national standards for protecting health information. The relevancy depends on the nature of the business’s industry, the work done and the customers.

 

• Analyze the IT environment. It’s no use designing a compliance policy that an organization doesn’t have the tools to comply with, nor is it effective to spend time developing a policy that is irrelevant to the technologies it uses. It can, however, be helpful to think ahead in terms of scaling and growth when developing IT policies.

 

• Consider the culture. Compliance isn’t just about technology. Policies should mirror the way people at the organization work and typical processes. Policies at odds with organizational culture are at high risk of being ineffective.

 

• Incorporate accountability. Leaders should understand the business risks of non-compliance and define roles and responsibilities for ensuring the organization meets its obligations.

 

• Document. Easily accessible written policies help support accountability and are critical in the case of an audit. Even if the company is in full compliance, a lack of documentation can trigger a failure. Even though some forms of compliance are essentially on the honor system, the lack of it can cause irreparable damage to a business’s reputation. Failure to comply with laws and other government or industry regulations can result in costly penalties.

 

• Monitor and test. There are tools that probe systems to validate compliance protocols are working as they are meant to and send warnings when they aren’t. In addition, Security Information and Event Management (SIEM) technologies keep a log of events to help identify and track intrusions or failures, which can be used to prevent non-compliance and show where systems need to be patched up.

 

• Review policies annually. Laws and regulations are often updated, technologies evolve, and businesses grow and change. It is essential to take the time to reassess compliance policies and their effectiveness every year.

 

Following Through with IT Integration

 

Compliance can be a complex area that requires significant effort, expertise and collaboration. But the risks of non-compliance in an increasingly tech-saturated business environment are too great to delay creating robust policies or implementing poorly thought-out processes.

 

Many organizations struggle with technology compliance, especially as they add more tools and scale their operations. Contact us or connect with us on LinkedIn for guidance in this critical area to ensure your business operates in line with your policies, laws and industry standards.