Compliance is an important focus for every business. Regulatory requirements are only the tip of the iceberg. Compliance also plays a role in ensuring that organizations meet the needs of their employees, leaders, and stakeholders. At the heart of how enterprises conduct their business, it's a top boardroom topic. When it comes to IT, with highly valuable business data and applications in the mix, the stakes run high. With the mainframe, leaders can stay sharp and to make compliance, transparency, and reporting a core part of a winning business strategy.
Compliance is a concept with so many nuances that any discussion about it can quickly devolve into confusion. At its core, compliance is how organizations meet their obligations and adhere to myriad requirements. The constantly evolving nature of those requirements, however, can make compliance feel less like a goal achieved and more like standing on shifting sands. Fortunately, there are solutions businesses can use not only to stay on solid ground, but also to get onto their front foot.
Navigating the compliance landscape has three major aspects:
All three of these are critical. Organizations that want to be open and accountable need to bake them into their business and IT strategies. Those who do will reap the benefits. Why? Compliance is about more than just filling out forms and checking off boxes: it’s about creating meaningful insights from large amounts of data to get a full picture of what is happening, why it is happening, and how it is happening.
Compliance exists at the intersection of cost and risk. Organizations that take it seriously have a massive business advantage, not simply a technical one. According to a recent article by two professors at the University of Connecticut, companies need to determine the right level of investment to drive compliance aimed not only at meeting their obligations, but also at keeping them competitive. The researchers determined that companies spend about $10,000 per employee every year to achieve compliance. That adds up in a hurry, but unfortunately still does not prevent compliance breaches from being an all-too-common occurrence. There clearly needs to be another layer.
Customers have to validate whether or not they are following the regulations that apply to their industries or geographies. This is a very manual process today. Auditors ask questions about whether or not passwords meet their standards, if all connections are encrypted, and if data is encrypted, to name just a few. In many cases, they are literally working through a checklist.
Providing affirmation with greater speed and accuracy across a hybrid IT environment has to be the path forward. The growing list of regulations that government agencies and industry bodies require – such as the Payment Card Industry Data Security Standard, EU General Data Protection Regulation, Health Insurance Portability Accountability Act, Sarbanes-Oxley Act, Society for Worldwide Interbank Financial Telecommunication, and Digital Operational Resilience Act (DORA) – present a challenge for businesses.
CISOs and CCOs routinely need to reaffirm that their processes, systems, and applications are following these standards. However, doing so is becoming more and more challenging due to the complexity and manual effort involved. Providing evidence of the implementation of such controls can take weeks to months to collect. By that time, the data is likely stale and compliance with the standards diminished, lowering the level of confidence. Compliance and proof of compliance need to exist in real-time.
Two separate bodies typically collect and interpret the evidence required for compliance reporting – Auditors, who are very familiar with the standards, and System Administrators, who are very familiar with the systems. These groups must collaborate to streamline and improve evidence collection.
Across virtually every industry sector, particularly those that are highly regulated, boardroom executives are not only concerned about the current state of affairs with regulations and compliance. They also seek robust systems, processes, and technologies that can handle what's coming down the road. To answer questions surrounding their level of compliance more quickly, auditors and C-level officers are taking advantage of automation.
Increasingly, this is being done through integrations with popular SIEM platforms such as Splunk and QRadar. These tools are able to find the proverbial needles in the haystack and analyze a handful of records that are critical for security and compliance.
Broadcom works with customers to simplify continuous monitoring of crucial mainframe areas with our Compliance Event Manager. This modern cybersecurity solution continuously monitors for configuration changes, policy violations, and anomalies. It prevents and limits damage and supplies forensics data to SIEM tools for enterprise-wide data analysis.
We also assist customers looking to ensure a trusted environment for their customers and employees through our Security Insights Platform. This solution opens up data access from multiple sources for integration, self-service, and automation. With just a few clicks, customers can find definitive answers to questions like: Who has access to system critical libraries? or Is my classified data pervasively encrypted? It also provides actionable recommendations for remediating discovered risks.
As the regulatory landscape continues to demand more from government and industry, we are investing to strengthen the security capabilities we offer our customers as well as to simplify their compliance process through integration and automation. For example, we enable organizations to identify the sources of regulatory data, classify the data, and then ensure that only those users who have the need can access the data. Identifying the source of sensitive data is just the start. Leveraging the capabilities our solution offers, clients can correlate the data sources they’ve classified with entitlements to pinpoint areas of risk – for example, not employing dataset encryption or adhering to a model of least privilege.
Through our strength and approach in security, data privacy, and compliance, we position our clients to solve their business challenges in compliance reporting so they are free to pursue their broader business goals with confidence.
If you’d like to discuss this topic further, please contact me directly at ronald.colmone@broadcom.com.