The state of security compliance
Compliance is delivering measurable business benefits yet proving it consumes a substantial share of security teams’ time. As regulatory pressures mount, the research examines whether existing approaches are helping organisations manage risk or adding to the workload.
From compliance burden to continuous resilience
Information security compliance has delivered some notable ROI benefits for respondents over the past year. But too often it’s also a drain on resources. A continuous approach is needed to restore faith in compliance, and help free teams to focus on what truly matters.
Security professionals may not be full-throated in their support for best practice standards and frameworks. But many of their organisations are reaping real business gains from such approaches.
Time savings from more efficient security processes are cited by the biggest share of respondents (32%). But many also mention improved business decision making (31%) and improved corporate reputation due to increased customer trust (31%). Notably, these are more positive reasons for compliance than simply avoiding regulatory fines, which is cited by fewer (30%) respondents.
Yet compliance work is still too burdensome for many, eroding GRC teams’ time, energy and morale. According to the study, respondents estimate their security and compliance teams spend an average of 31% of their time proving compliance rather than improving security. And half say it takes up more than a quarter of their time.
Security professionals may not be full-throated in their support for best practice standards and frameworks. But many of their organisations are reaping real business gains from such approaches.
Which, if any, of the following is your security and compliance team currently experiencing
Over a fifth (21%) complain that they’re either stretched too thin or spend most of their time on routine, low-stakes work. This can take many forms, including mapping requirements to controls, testing controls and chasing owners, completing questionnaires, and managing policies, remediation and risk assessments.
One of the most onerous tasks can be audit preparation: a scramble for evidence every few months which leaves many teams reeling. It’s no surprise that many respondents complain of too much manual repetitive work (20%), burnt-out teams (21%), low morale (16%) and being forced to do the same work with fewer people (19%).
This is already an industry suffering from a dearth of skilled workers. More may leave unless these practices change, leaving fewer to pick up a mounting workload. Two-fifths (40%) of respondents cite a skills gap, over a quarter (27%) say they have difficulty hiring, and fewer than last year expect spending on recruitment to rise (49%, down from 64%).
This is already an industry suffering from a dearth of skilled workers. More may leave unless these practices change, leaving fewer to pick up a mounting workload.
The bigger picture
In reality, this is not the fault of “compliance” per se. It is symptomatic of programmes built for a different age: a more static world of work characterised by manual effort and point-in-time attestations of compliance. But times have changed. Today’s businesses move at machine speed. Change happens on an almost daily basis: in the threat landscape, IT infrastructure, business processes, supply chain, and the regulatory environment.
In this context, periodic snapshots of security posture don’t make an organisation more secure or better governed. All they do is increase the workload for already stretched teams. It’s in the gaps between these snapshots where controls drift and risk escalate. Yet over a quarter (29%) of responding organisations told us their view of compliance and control status is only as current as their last audit. A further 14% admit they’d have to pull evidence together from scratch to know where they stand.
Periodic snapshots of security posture don’t make an organisation more secure or better governed. All they do is increase the workload for already stretched teams.
According to separate IO research, a third of senior cybersecurity professionals believe that true resilience comes instead from continuous compliance. This means streamlining evidence collection and remediating control drift on an ongoing basis, to manage risk when it appears and not several weeks or months later. This could help improve operational security and resilience, while reducing costs, boosting morale, freeing up staff to work on high judgement tasks, and improving regulatory readiness. It’s sorely needed. Some 70% of respondents claim that the speed and volume of regulatory change make it increasingly difficult to stay compliant. And a fifth say new requirements are likely to cause “major upheaval”.
At any given moment, how current is your view of your compliance and control status?
The value of standards
Security professionals may be surprised to find that such an approach aligns with standards like ISO 27001, ISO 27701 and ISO 42001. In fact, continuous improvement has always been at the heart of the ISO approach, meaning teams are urged to adapt security controls, mitigate new risks, and close gaps as and when they appear, rather than following a pre-planned audit.
Fortunately, things are changing in many organisations. A quarter (26%) of respondents tell us that when a new regulation lands, it mostly maps onto controls they already have. A slightly bigger cohort (27%) are even further along, claiming that they’re usually able to prepare ahead of time, so the new requirements are absorbed with little disruption. This is a major benefit of a “continuous loop” approach to compliance which combines infosec, privacy and AI governance.
Yet there’s still work to do. While half (48%) of respondents say they want to increase their use of automation, only 17% say they’re making it a priority to reduce reliance on manual processes to manage compliance. Until they do, their teams will continue to struggle. And as they automate, human oversight matters, 39% already cite tasks being replaced by AI without human checks for compliance as a challenge.
Thinking about automation and API integrations in your compliance and security work (e.g. tools that pull evidence automatically from your systems), which of the following apply?
