Challenges for InfoSec & Compliance

One of today’s bigger challenges for CISOs, CTOs and CIOs is understanding all aspects of their information security (InfoSec) posture based on compliance and business requirements. Here is an example of a common problem I have seen many times.

In order to design or enhance a company’s information security, the InfoSec department must first assess and understand the current security infrastructure. In order to do this, the InfoSec team begins by collecting all the diagrams and technical documents from all the departments. Once all these documents are collected, InfoSec must validate and map the listed and depicted security controls against compliance and business requirements.

This challenge continues with an interview with the head of each department to understand their known, implemented security controls. But the challenge grows because each department only has expertise in their own domain and not in security frameworks or compliance expectations. With this gap of understanding, InfoSec must painstakingly investigate to find any missing security controls. Finally, InfoSec gets to design the necessary controls and make sure they are implemented and maintained correctly.

The best way to eliminate these gaps and achieve reliable posture and compliance understanding is to perform a detailed assessment of each of the security and compliance policies across all departments. From here, you will have a complete, accurate and well documented understanding of your information security posture and what is needed to achieve compliance. With an automated system you will be able to track the progress of each step of the process and each project needed to get there.

I hope this helps you understand some of the challenges and options available to improve the visibility and understanding of your InfoSec posture. Stay tuned for more coming soon.