Step 1: Identify Impact of Compliance
In this first step, enterprises identify how the compliance initiative affects the IT function by linking business processes to IT procedures, applications, and data. The impact of compliance initiatives should be assessed, along with an estimation of costs, in order to determine a plan of action, based on specific compliance legislation and industry practices.
Info-Tech Tip: Compliance efforts can affect application access rights, data access rights, report distribution, and reporting requirements. Communicate early on how system changes will affect users and why the changes are necessary to increase understanding and to create buy-in for project implementation.
|
 |
1.1 Identify IT Controls that Meet Compliance Requirements
The first steps in the compliance assessment are to:
- Identify process owners, affected resources, applications, relevant logs, and data related to the compliance initiative.
- Review policy and processes in order to determine which of these will be affected in the compliance initiative, or exist already to meet compliance needs.
Estimate the impact that compliance demands will have on IT using the "Compliance Impact Assessment" tool. Next, use the "Internal Control Identification Tool" to conduct an inventory of all controls present within the organization. The tool will recommend the implementation of these controls based on selected answers. Finally, assess IT policy gaps by completing the "Policy Assessment Tool."
|
|
- How to Identify Control Objects for Compliance and Governance
- Controls for Compliance: When "Good Enough" Is Good Enough
|
 |
1.2 Optimize Response to External Requirements
In this step, examine specific legislation, and industry-driven requirements to help determine what form the enterprise’s specific compliance initiatives will take. To help identify external requirements, use the Optimize IT tools that most closely correspond to your enterprise’s compliance needs:
- HIPAA Security Assessment Checklist. A checklist tool for healthcare industry enterprises bound by US Health Insurance Portability and Accountability Act (HIPAA) regulations.
- Gramm-Leach-Bliley Act Security Assessment Checklist. A checklist for finance and insurance sector enterprises based in the US, or otherwise bound by US legislation, for GLBA-specific security issues.
- SOX Compliance Assessment. An assessment for compliance with Sarbanes-Oxley regulations that applies to financial reporting and accounting practices for any organization that is publicly traded in any US stock market.
- Payment Card Industry Security Assessment Checklist. Applicable security standards for any enterprise that deals with electronic payment cards and the Payment Card Industry (PCI) standard.
- Federal Rules of Civil Procedure Readiness Assessment. A checklist covering requirements for compliance with the new Federal Rules of Civil Procedure (FRCP) established in 2006, covering e-mail and other data storage and retention issues.
|
|
|
Step 2: Prioritize and Plan
Once compliance requirements have been laid out alongside the enterprise’s technology environment, it is time to prioritize the mitigation of known gaps based on compliance requirements. This step is vital as a demonstration of progress to stakeholders, but is equally important for managing compliance projects, which tend to be long-term in scheduling and complex by nature.
Info-Tech Tip: Compliance efforts can affect application access rights, data access rights, report distribution, and reporting requirements. Communicate early on how system changes will affect users and why the changes are necessary to increase understanding and to create buy-in for project implementation.
|
|
2.1 Gain Positive Assurance of Compliance
Managing compliance efforts like any other project is necessary for the successful implementation of the compliance project. Communicate compliance gap measures by developing a work plan for all compliance tasks, and managing change through strong internal communication practices.
- Use the "Work Plan Template" to plot out tasks, scheduling, and estimated budgets for compliance-driven projects. The "Change Communication Worksheet" can be used to communicate projects and compliance-driven change to stakeholders. Fill in the blanks and follow recommendations to improve the flow of communication around compliance initiatives.
|
|
- Manage Project Issues to Avoid Nasty Surprises
- Eight Downfalls of Organizational Change Efforts
- Eight Communication Tips to Make Changes, Not Enemies
|
Step 3: Report on Compliance Efforts
At the heart of the compliance initiative is the need to demonstrate progress to auditors, management, and others. Since compliance in IT is typically driven by externally legislated requirements, reporting the progress to vested interests is essential to a successful compliance initiative.
Info-Tech Tip: Assessing the cost of the compliance initiative after the fact is only effective as a learning exercise for future projects. Budgets are better managed if they are monitored while in progress: the earlier a budget discrepancy is caught, the closer the project will come to its pre-determined cost.
|
|
3.1 Issue Reports to Stakeholders, Owners, and Requestors
Keeping track of the costs and milestones of compliance-related tasks is essential to managing each project. Effective monitoring of scheduled tasks will ensure that the compliance project comes in on time and within budget.
- Use the "Project Status and Cost Report" tool to monitor compliance projects by inputting project schedule and cost estimates, and monitoring milestone dates to ensure your compliance initiatives are on track.
|
|
|
|
3.2 Assemble Compliance Inventory and Portfolio
Reporting efforts to executives is a necessary part of any project, and is particularly important when it comes to compliance driven tasks. However, to be effective for executive reporting, a portfolio tracking project status should only highlight important project details as required.
- Record summary-level information from various "Project Status and Cost Report" entries into the "Compliance Portfolio Tracking Tool" to report on the high-level status of multiple on-going compliance projects to executives or external stake-holders
|
|
|
Compliance Impact Assessment
GLBA Security Assessment Checklist
