The True Cost of Compliance
•Transferir como PPTX, PDF•
1 gostou•585 visualizações
Ponemon Institute and Tripwire have completed their annual cost of compliance benchmark study of multinational organizations. The study reveals that the costs of non-compliance, which includes disruption of services, fines, legal fees and more, is almost three times the cost associated with compliance. It also provides insight into activities organizations can undertake to reduce the cost of compliance while also improving security. In this webcast, Larry Ponemon, Chairman and Founder of Ponemon Institute presents key findings of the study including: The costs associated with compliance and non-compliance. Factors that may reduce these costs such as a strong security strategy or ongoing compliance audits. Steps organizations can take to reduce risk, protect data, improve security and support compliance activities across the organization. How Tripwire® VIA™ solutions can help organizations achieve compliance to avoid the high costs of non-compliance
Recomendados
Recomendados
Mais conteúdo relacionado
Mais de Tripwire
Mais de Tripwire (20)
Último
Último (20)
The True Cost of Compliance
- 1. The True Cost of Compliance Join the conversation: #compliancecost
- 2. Dr. Larry Ponemon, Ph.D. Ponemon Institute LLC Rekha Shenoy VP Marketing, Tripwire Inc. Join the conversation: #compliancecost
- 3. Today’s Speakers Ph.D. Chairman and Founder, CIPP
- 4. Join the conversation: #compliancecost
- 5. • • • • • • Join the conversation: #compliancecost
- 6. • • • • Join the conversation: #compliancecost
- 7. Join the conversation: #compliancecost
- 8. Join the conversation: #compliancecost
- 9. Benchmark response Freq. Contacted 399 Agreement 67 Participation 50 Incomplete studies 4 Final sample 46 Join the conversation: #compliancecost
- 10. Join the conversation: #compliancecost
- 11. Approximate titles of 160 respondents Join the conversation: #compliancecost
- 12. Join the conversation: #compliancecost
- 13. Join the conversation: #compliancecost
- 14. Join the conversation: #compliancecost
- 15. Average Compliance Cost by Activity Center Six cost activity centers span the full economic impact of compliance costs associated with protecting data Join the conversation: #compliancecost
- 16. Average Non-Compliance Cost by Activity Center Four cost activity centers span the full economic impact of non-compliance costs associated with protecting data Join the conversation: #compliancecost
- 17. Laws and Regulations: Main Drivers for Investments Industry and organizational size affect the cost of compliance and non- compliance. Join the conversation: #compliancecost
- 18. Industry and Size Affect the Cost of Compliance Industry and organizational size affect the cost of compliance and non- compliance. Join the conversation: #compliancecost
- 19. Difference in Costs is Related to Data Breach Frequency The smaller the gap between compliance and non-compliance costs, the lower the frequency of compromised records Join the conversation: #compliancecost
- 20. Secure Organizations Have Lower Non-Compliance Costs Organizations with a higher security effectiveness score experience a lower cost of non-compliance. Join the conversation: #compliancecost
- 21. Ongoing Audits Reduce the Total Cost of Compliance Per capita non-compliance cost are inversely related to the frequency of compliance audits. Organizations that do not conduct compliance audits experience the highest compliance cost. Join the conversation: #compliancecost
- 22. For more information www.tripwire.com/ponemon-cost-of-compliance Join the conversation: #compliancecost
- 23. Larry Ponemon, Ph.D. www.tripwire.com Ponemon Institute, LLC E-mail : larry@ponemon.org Join the conversation: #compliancecost
Notas do Editor
- Table 1 summarizes the total, average, median, maximum and minimum compliance costs for each of the six activity centers defined in our cost framework in Part III. Please note that these cost statistics are defined for a 12-month period. Data security represents the largest cost center for the benchmark sample, while policy represents the smallest.*Sixty-four percent of this center pertains to the direct and indirect costs associated with enabling security technologies.
- Table 2 summarizes the total, average, median, maximum and minimum non-compliance cost for each one of four consequences defined in our framework for a 12-month period. Business disruption represents the most costly consequence, while fines, penalties and other settlement costs represent the least costly consequences of compliance failure.
- Finally, results suggest that compliance with laws and regulations (external focus) appears to be the most important mission of compliance efforts. Regulations that are a priority include the Payment Card Industry Data Security Standard (PCI DSS), various state privacy and data protection laws (such as MA 201 in Massachusetts), the European Union Privacy Directive, and Sarbanes-Oxley. Organizations are investing in specialized technologies to protect their data such as file integrity monitoring, security information and event management, access management, data loss prevention, and encryption. Our final analysis examines how 160 respondents in our sample of 46 benchmarked organizations view different data compliance regulations in terms of importance and difficulty. Although certain regulations like HIPAA and GLBA are industry-specific, the summarized data in Table 3 is for all industries of surveyed respondents. This data clearly shows that PCI DSS, various US state data breach or privacy laws such as Massachusetts, Sarbanes-Oxley and the EU Privacy Directive are of greatest concern to respondents.
- Results show that the total cost of compliance varies significantly by the organization’s industry segment, with a range of $6.8 million for education and research to more than $24 million for energy. The difference between compliance and non-compliance cost also varies by industry. Energy shows the smallest difference at $2 million, and technology shows the largest difference at $9.4 million.When adjusting compliance and non-compliance costs by each organization’s headcount, we see smaller-sized companies (5,000 or fewer employees) as incurring substantially higher per capita compliance costs than larger-sized companies (more than 5,000 employees).While the study found that the cost of compliance is affected by organizational size, it is also affected by the number of regulations and the amount of sensitive or confidential information an organization is required to safeguard.
- We tested the premise that increasing the amount of compliance spending offsets the cost of non-compliance. Our findings show a positive correlation between the percentage difference between compliance and non-compliance costs and the number of lost or stolen records during a 12 month-period. In other words, the smaller the gap between compliance and non-compliance costs, the lower the frequency of compromised records.
- Figure 22 shows the relationship between per capita compliance and non-compliance cost and internal audit frequency. Organizations that conduct three to five internal compliance audits per year have the lowest per capita compliance cost (average $154). The highest compliance cost (average $341) is associated with organizations that do not conduct any internal compliance audits. This figure shows an inverse relationship between per capita non-compliance cost and audit frequency. Here, the highest per capita non-compliance cost (average $1,275) is associated with organizations that do not conduct audits. The lowest per capita non-compliance cost (with an average of $226) is associated with organizations that conduct five or more audits.