When Compliance isn’t Good Enough: Thinking Beyond Regulations is a Must

• By Mark Casetta
• Dec 09, 2019

With the January 2020 deadline for CCPA compliance looming, what lessons from GDPR compliance apply most this time around? Topping the list should be thinking and acting beyond compliance to build and sustain a long-range view of data security.

Achieving compliance should be seen as passing a milestone, not crossing the finish line.

‘Compliance is a seat belt on a 747’

In a recent presentation, Dr. Chase Cunningham, principal analyst at Forrester serving security and risk professionals, says, “Compliance is a seatbelt on a 747. You’ve got to have it to back away from the gate; it’ll probably help you if you hit some turbulence on the way. However, if things go really bad, does anyone really think a three-inch strip of nylon is going to make you walk away from a plane crash? Absolutely not. Compliance is not a strategy.”1

Dr. Cunningham is absolutely right. Compliance is an important checkmark, but not a strategic lever for driving an effective data protection strategy. Focusing on short-term compliance goals and settling for checkmark solutions might suffice initially but will fall short in the long run.

No one wants to realize a year later that the decision wasn’t part of a holistic strategy. This narrow-minded thinking can set you back by opening the door to unforeseen vulnerabilities.

Start with a Data Protection Mindset

Compliance should be a byproduct of an overarching security strategy, with greater focus on data protection as the pivotal point of entry. Think of compliance as the “what.” As in what is driving short-term action? Then, quickly move to the “why.” Why do I want to be compliant? The answer should always be “to protect my data.”

While compliance can provide useful guardrails, it doesn’t go as far or wide in delivering all the necessary protection, especially in terms of personal data privacy.

Do the Right Thing: Respecting Personal Data Privacy

After watching Mark Zuckerberg get raked over the coals before Congress recently, it’s easy to see that privacy is—and should be—on everybody’s mind. Companies of all sizes across every industry must focus on doing the right thing—for their business, customers and employees—by tackling the pervasive personal data privacy problem.

Finding all the places personal data exists is tricky as it proliferates across emails and files as soon as they’re created. That’s why it’s wise to gain a thorough understanding of the current data environment and impact of personal data on the existing security architecture.

It will take time to gauge how much personal data is created on a daily basis. So, iterative steps, and even a handful of tools are recommended to assess personal data risk exposure accurately.

Mindset Drives Methodology

Proper data security requires risk assessment and abatement as an ongoing evolution characterized by persistence and patience. Look for tools that deliver incremental value. Diligence is necessary for revisiting risk profiles and identifying security gaps.

Be mindful of cultural implications and upfront in communications about the importance of having a shared security responsibility. It’s not about putting burden on employees to ensure privacy is a front-and-center issue. It’s more about providing a methodology that reduces risk without making it more difficult for employees to do their jobs.

Look for solutions that automate and simplify the process to facilitate more widespread acceptance. Whether motivated by doing right by employees and customers or avoiding significant fines—remember, achieving compliance simply isn’t good enough. What’s most important is ensuring proper protection policies bolster data privacy while putting the organization on a strategic security path.

1. Dr. Chase Cunningham, SecurIT Summit 2018