Start-Up Secure

CHAPTER NINECompliance

You have 20 seconds to comply.

– ED-209, Robocop

WHEN A COMPANY IS REQUIRED or chooses to be compliant with a specific standard or framework it is important to understand what compliance means. After completing your first audit, regardless of the standard, and receiving some type of certification or official document you can have an overwhelming feeling of relief and that you are finished. This is not the case. Becoming compliant with a standard can lure you into a false sense of security. Compliance is meant to hold a minimum standard for a sustained period of time. Doing so does not necessarily mean your company is secure.

Nearly all cybersecurity compliance standards and regulations have some form of exception acceptance. It can be time-consuming and costly to achieve a flawless audit and may not benefit you or your customers by having zero exceptions. And just as there are exceptions for audits, there are exceptions to the fact that you may need to have a flawless audit depending on your industry. Highly regulated industries like healthcare, finance, and government contractors in some cases have no choice.

It seems today you can't swing an Ethernet cable without hitting a company that must comply with some type of government regulation or industry compliance requirement. While they have the best intentions, the road to a significant data breach is paved with the best intentions. No regulation or industry compliance advisory board will ever be able ...