This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Find out more here

Hide
Jump to navigation

Governance and Regulatory Compliance

Organisations face an ever increasing list of statutory, regulatory, contractual and legal compliance obligations.

Compliance issues should concern the board, not just the IT department, and include issues of Data Governance, the Data Protection Act, Operational Risk, Information Security, Best Practice and Basel II/III.

Learn more about regulatory compliance and which affect your organisation.

On this page:

Common Compliance Requirements

In today's complex regulatory environment, organisations must:

  • grapple with the complexities, costs and overlaps of governance requirements (Combined Code, Turnbull, Sarbanes Oxley, Basel II, etc.);
  • comply with a wide range of information-related regulation, from the Data Protection Act to GLBA, HIPAA, PIPEDA and the Computer Misuse Act;
  • deal with an increasing exposure to rapidly mutating, sophisticated threats to their information and information assets, which exploit a diversity of technical vulnerabilities in IT systems as well as loopholes in procedures and the behavioural characteristics of employees.

The table below lists the most common compliance regulations that organisations have to comply with, what security areas they cover and the compliance requirements:

Regulations Who Needs to Comply Security Areas Covered Compliance Requirements
HIPAA
US healthcare organisations and partners

Creating, storing and transmitting electronic protected health information

All major "Best Practice Security" areas

Sarbanes Oxley (SOX) & Acctg Standards COSO, COBIT®, SAS

US public companies

Defined to secure the public against corporate fraud and misrepresentation

All major "Best Practice Security" areas

PCI DSS
(Also Covered by Breach Laws)

Merchants who take credit cards
Privacy of Customer Financial Data

Varies by size of merchant, requires Best Practices plus 3rd Party Quality Risk Assessments

GLBA - Federal Law 106 - 102 FDIC/FFIEC Guidelines FACT U.S. Patriot Act (2001)

US financial institutions

Financial Services Act - Privacy of Personal Info. Safety of Internet based Products & Services Fair and Accurate Credit Transactions Anti – Terrorism

"Best Practices", Security Two-Factor Authentication, ensure Accuracy & Safety Identity Verification

Breach Laws in 31 US States Including California SB 1386
Any company storing, or accessing private consumer data
Consumer Privacy - Security Breach Acts
All major "Best Practices Security" areas
EU Data Protection Act and Privacy Regulations
Any EU organisation holding personal data
Personal data
All major best practice areas

Data Governance

Data Governance is primarily concerned with the Data Protection Act and privacy regulations. All organisations in the UK which store, transmit or process personal data must be DPA compliant. If you suffer a data breach and are not DPA compliant the Information Commissioner's Office can levy fines of up to £500,000. Find out more information on our bespoke DPA compliance page.

PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) has been devised to increase security around card transactions. Acknowledged the world over, compliance to the PCI Standard is mandatory for card-accepting organisations. The standard requires merchants to demonstrate a secure IT network that protects card holder data, maintain a vulnerability management programme, implement access control measures and regularly test their networks. Find out more information on our bespoke PCI DSS page.

Sarbanes Oxley Act

From 2002, the Sarbanes-Oxley Act (SOX) enforces US organisations to demonstrate corporate governance compliance. SOX requires management to certify the company’s financial reports, and both management and an independent accountant are required to certify the organisation’s internal controls. This has a huge dependency on the IT infrastructure and IT systems. Find out more information on our bespoke SOX page.

Basel Accords (Basel II & III)

Basel III is the latest instalment of the Basel Accords, which set out a regulatory standard for the financial industry. Basel III has been developed in response to the global financial crisis which started in 2008; it is expected to be introduced from 2013 to 2018. Its predecessor, Basel II, was created to ensure that banks put aside enough capital to safeguard against operational, financial and economic risks. In essence Basel II stated that the greater risk a bank exposed itself to, the greater capital it should hold. Find out more information on our bespoke Basel II/III page.

Compliance & Best Practice

ISO 27001, ITIL® and COBIT are all potentially part of a best-practice approach to regulatory and corporate governance compliance.

The challenge for many organisations is to establish a coordinated, integrated framework that draws on all three of these standards. The Joint Framework, combining COBIT and ITIL, is a good starting place.

ISO27001, the international standard for an information security management system (ISMS), also sets out a best practice approach. This standard links to all the IT-related regulations and provides completely independent structured guidance for a risk-based approach to securing the confidentiality, availability and integrity of corporate information. It also provides the general control environment within which the specific controls of an internal control structure can most effectively operate. Find out more about ISO27001 and how it can help with compliance on our designated ISO27001 page.

+44 (0) 845 070 1750
live chat support software