- Welcome to lesson 26.
Summarize the elements of effective security compliance.
In lesson 26.1, we're gonna focus in
on compliance monitoring.
Now, as a refresher compliance means acting in accordance
with applicable rules, laws, policies and or obligations.
And that organizations are responsible
for complying with all local, state, federal
and union laws and regulations.
And by union, I mean union of states or countries
like the European Union or the European Economic Area,
international agreements and treaties, as well
as organizational agreements and contractual obligations.
And additionally, considerations should be given
to local customs, traditions and practices
be they cultural, tribal or religious.
Jurisdiction being the power or the right
of a legal or political agency to exercise its authority
over a person, a subject matter or a territory.
And we talked earlier about jurisdiction.
Now in relation to cyber,
if you remember jurisdiction pertains to the location
of data and systems in all of its states, processing,
transmission and storage.
The type of data, is it personally identifiable data?
Is it financial data?
Is it healthcare data?
Is it educational data?
Is it data that belongs to a minor under the age of 13?
The residents of the data owners
and the residents of the data subjects.
And it's really incumbent upon an organization to know all
of their applicable jurisdictions.
So you wanna be able to document
all your applicable jurisdictions, including location,
resonance and data sets.
And this is a fantastic whiteboard exercise
although it's many more than one whiteboard, right?
You may have a whole room full of whiteboards,
but you wanna do this like now if you haven't already done
this in an organization because you need to know, right
what your jurisdictions are so you know what laws
and rules and regulations you have to comply with.
So what is the consequence of not knowing or knowing,
but not complying?
Well, could be fines, sanctions,
resource utilization issues, a loss of a license,
contractual impact or reputational damage.
There could be fines that are levied
by a regulatory agency or by a court.
In worst case scenario, potential jail time.
There could be sanctions that are opposed
by the regulatory agency or by a court.
You may have to reallocate resources to address issues
and the issues take much longer, like to address or to fix.
And if you had just done the right thing to begin with.
You might lose an operating license, a permit or a charter.
You may have penalties or relationship damage
or loss of trust from those that you have contracts with.
And you'll definitely have reputational damage,
which is loss of stakeholder trust and respect.
So compliance monitoring is the active process
of evaluating our activities, our practices
and our behaviors to verify compliance
and then to proactively identify any deviations
or non-compliant actions.
Now, there's already been these deviations or non-compliant,
but we wanna recognize this, right?
We wanna find them in our own organization
and fix it before perhaps a regulatory agency identifies it
or there's any other consequence.
Now, compliance monitoring is used to identify areas
for improvement as well
and enables early detection of non-compliance.
So how do we monitor?
Well, monitoring activities include manual inspections,
audits, data analysis, automated systems,
a favorite or specialized tools.
So let's talk about automated compliance monitoring.
Automated compliance monitoring utilizes automated tools
to monitor and to assess compliance.
Now, what's the benefit of an automated system?
Well, automated systems can analyze large volumes
of data in real time, right to identify patterns, anomalies
or potential compliance breaches.
Now, automated systems can also be programmed
to generate alerts or notifications when specific conditions
or thresholds are met.
Automation also has a good audit trail
so it can help maintain those audit trail documentation
that you're gonna need for compliance purposes.
And automated tools can monitor regulatory changes
and updates in real time.
So what else are you supposed to be doing?
And those of you who are in regulated industries
you know that regulations change fairly frequently.
So how do you know if you are baseline controls really
are in compliance with all of your obligations?
Well, you wanna undertake what's known
as a baseline modification process, which really is this.
We're gonna establish a criteria.
We need to say, okay
what regulatory requirements do we have?
What are we supposed to be doing?
We're gonna engage in monitoring activities
that could be automated monitoring
like we just spoke about, or manual monitoring.
That'll allow us to gather data.
Are we in compliance?
Are we not in compliance?
Are we close?
Are we really far off?
We'll, then be able to assess what we need to be doing
and identify any non-compliance activities
that we are engaged in or things that we're just not doing.
So issues by omission, just things we're not taken care
of or things that we should be doing.
And then we're gonna take corrective action
because we wanna be in compliance.
We should document all of this and then report.
Now, report out as applicable.
It's always good to document what you found
and then report as to what you did.
Now, particularly for compliance, because
if a regulatory agency or anyone who's assessing you
or auditing you or examining you comes in and says, well
you're not doing the right thing, it always works better
if you can say, yes, we found that.
We recognize that.
Here's what we know we didn't do.
Here's what we know we need to do and here's how
we're changing our system to meet those requirements.
And that would be how we would do a baseline modification
for compliance.
All right, that my friends
brings us to a three-second challenge,
five challenge questions, three seconds each.
A monetary penalty levied by a regulatory agency or court.
One, two, three.
That's gonna be a fine.
Number two, acting in accordance
with applicable rules, laws, policies and or obligations.
Oh, this is an easy one.
One, two, three.
That's compliance.
Number three, activity used
for early detection of non-compliance.
One, two, three.
That's gonna be compliance monitoring.
Number four, term used to describe processes
or operations that require minimal or no human intervention.
One, two, three.
We've used this term a lot in this course.
That's gonna be automation.
And lastly, number five, the power or right of a legal
or political agency to exercise its authority over a person
a subject matter or a territory.
One, two, three.
That's gonna be jurisdiction.
Right, that brings us to a security-in-action.
This one is about compliance monitoring.
The credit union you work at recently underwent
a compliance exam and there were numerous findings
and the examiners were requiring
that the credit union enhance
their compliance monitoring processes.
Now, the organization's really small,
current staff is overburdened
and hiring more staff is a challenge.
So you suggest automation.
The CEO asks you to explain the benefits
of an automated compliance monitoring system.
What are you gonna say?
So you work at a credit union,
you just had a compliance exam by your regulators.
There were numerous findings.
The examiner say you really have to do better
at monitoring your compliance,
but the organization's very small.
Your current staff already overburdened.
And hiring more staff these days is really a challenge.
So no expectation you're gonna be able to add to your staff.
So you say, okay, well, we can't add to the staff,
but we have to respond to our regulators.
How about automation?
And the CEO says, okay, well, lets sit down.
Explain to me the benefits
of automated compliance monitoring.
What are you gonna say?
So go ahead and put me on pause,
jot down some notes about automation.
Well, automation has several benefits
and here are just a few.
Automation reduces manual efforts,
eliminates repetitive tasks and can handle volumes
of data freeing up resources for other activities.
Automation monitoring processes are consistent
and they are not prone to human interpretation or error.
Maybe someone's just distracted or hungry
and they don't notice the issue.
Now, automation can provide real time monitoring.
And automation is scalable.
So as the credit union grows, automation can grow with it.
Or maybe the credit union isn't growing, but the amount
of regulations they have to comply with grows.
In that case, automation is also scalable.
So having this conversation and understanding the benefits
of automation to your organization,
absolutely security-in-action.
There's your Word Cloud.
You know what to do.
I'll see you the next lesson.