Compliance activities and fines costing organizations huge bucks annually: Survey

Organizations are struggling to keep up with IT security and privacy compliance regulations, according to Telos-Vanson Bourne’s survey. The survey, which polled 300 IT security professionals in July and August 2020, revealed that, on average, organizations must comply with 13 different IT security and/or privacy regulations and spend USD 3.5 M annually on compliance activities, with compliance audits consuming 58 working days each quarter.

As more regulations come into existence and more organizations migrate their critical systems, applications and infrastructure to the cloud, the risk of non-compliance and associated impact increases. Key findings from the survey include:

• IT security professionals report receiving an average of over 17 audit evidence requests each quarter and spend an average of three working days responding to a single request
• Over the last 24 months, organizations have been found non-compliant an average of six times by both internal and third party auditors resulting in an average of eight fines, costing an average of USD 460,000
• Nearly nine in 10 organizations (86%) believe compliance would be an issue when moving systems, applications and infrastructure to the cloud
• 94% of organizations report they would face challenges when it comes to IT security compliance and/or privacy regulations in the cloud

“Compliance teams spend 232 working days each year responding to audit evidence requests, in addition to the millions of dollars spent on compliance activities and fines,” said Dr. Ed Amoroso, CEO of TAG Cyber, a global cyber security advisory, training, consulting, and media services company. “The bottom line is this level of financial and time commitment is unsustainable in the long run.”

“As hammer, chisel and stone gave way to clipboard, paper and pencil, it’s time for organizations to realize the days of spreadsheets for ‘checkbox compliance’ are woefully outdated,” said Steve Horvath, vice president of strategy and cloud at Telos. “Automation can solve numerous compliance challenges, as the data shows. It’s the only real way to get in front of curve, rather than continuing to try and keep up.”

Nearly all survey respondents (99%) indicated their organization would benefit from automating IT security and/or privacy compliance activities, citing expected benefits such as increased accuracy of evidence (54%), reduced time spent being audited (51%) and the ability to respond to audit evidence requests more quickly (50%).