Stifled by Another Compliance Mandate?

Seems like every year there’s a new/modified cybersecurity regulation, standard, or compliance framework that thrusts itself to the forefront of our collective psyche. This year, that clearly was GDPR.  While the semantics of each vary, the premise (protect data) and overlapping controls are very similar. 

The table below is not meant to be comprehensive, but to illustrate this.

The Corporate Application Compliance Framework

With the right knowledge and planning, meeting the application-driven requirements is easier than most organizations think. This can be accomplished by: 

1. Align development processes to implement specific secure coding practices that align with corporate policies and compliance requirements
   
   
2. Create an action plan to address gaps between current secure coding practices and the desired ones

Development groups typically concentrate on delivering functionality and meeting schedules because they perceive that management priorities place these goals far ahead of application security and compliance.

To counteract this tendency, teams need guidance from management on topics such as:

• The importance management places on data security and compliance
• The direct impact software applications have on data security risks
• The business implications of not meeting compliance mandates 

In other words, enterprises need an explicit process for translating compliance requirements into actionable steps for IT teams. Because there are few resources for this, I suggest the Corporate Application Compliance Framework, illustrated below. 

At the top level, the enterprise risk management (ERM), human resources and legal groups define the global scope and requirements for corporate governance. These are based on company mission, risk tolerance and regulations affecting the organization.  

At the middle level, an ERM group, together with representatives of the compliance and security teams, take the corporate security and compliance standards and add detail to create security policies for the company. These are high-level guidelines for operational security and compliance activities that can later be contextualized for specific business units and functional roles.

Typical tasks at this level include:

• Keep abreast of applicable regulations and standards
• Conduct a threat assessment to determine the security breaches potentially most damaging to the enterprise
• Classify data assets to define levels of data sensitivity and identify which business processes store and transmit sensitive data
• Define concrete application security objectives

At the base level, the security and compliance teams help define specific practices for documenting compliance and ensuring they address business-unit-specific regulations and technologies. Standardized practices improve consistency, reduce errors, and facilitate testing. Most importantly, they provide a benchmark against which compliance can be measured.

“Connecting these dots” requires a range of experts to pool their knowledge to triangulate between:

1. Applicable regulations and standards
2. Probable threats and application-related vulnerabilities
3. Application security techniques and coding practices

While coding standards/best practices can vary, the following table summarizes the more important, grouped by high-level requirements.  

 Corporate Application Compliance Framework

While this mapping can be time consuming, the more specific and practical the guidance, the easier compliance will be achieved.

Security Innovation has the industry's largest selection of secure coding courses that map to more compliance mandates and cover all major languages and platforms.