(c/o DK) http://www.eweek.com/article2/0,1759,1853246,00.asp?kc=EWRSS03129TX1K0000614
Real Research or a Marketing Ploy? August 29, 2005 By Cameron Sturdevant The impact of regulatory compliance on IT security is nearly impossible to measure accurately. However, a research survey launched on Aug. 24 by BindView Corp., The Institute of Internal Auditors and the Computer Security Institute purports to get a baseline assessment of just that. I think the survey results will be interestingespecially to auditors and vendors with compliance products to sellbut I'm not sure how much the survey respondents will actually get out of the process. The survey is active now, and I want to preserve the sample selected by the survey's sponsors, so I won't provide the URL here. I will say that the survey is designed for CSOs, is composed of 30 questionsmostly multiple choiceand is comprehensive in covering all the regulatory bodies that are currently picking over corporate IT and finance departments. There are two problems with the survey from the point of view of the CSO who is being asked to submit answers. The first is that the survey appears to lack a systematic method for eliciting the actual number of staff hours that are expended to comply with various aspects of complying with regulations. The second problem, as I said above, is that it will likely provide very little real benefit to participants. Companies that have stringent regulatory responsibilities assigned to them by law already know what they are supposed to be doing. This means that the respondents providing data to the third-party sponsors of the research survey won't be getting anything more valuable than that an affirmative response that various businesses in the sample indeed must comply with this or that specific rule. In areas of the survey where less is known about the actual requirements of an audita common complaint about Sarbanes-Oxleyit appears that, for the time being, it's probably enough to demonstrate that a system of controls is in place. When it comes to making decisions about how to comply with regulatory mandates, having more and better information is always better than getting less and poor-quality data. However, the survey I got in my e-mail appears to be a survey of potential customers, rather than an unbiased research tool that will shed light on the best way for companies to meet their responsibilities under the law. You are a subscribed member of the infowarrior list. Visit www.infowarrior.org for list information or to unsubscribe. This message may be redistributed freely in its entirety. Any and all copyrights appearing in list messages are maintained by their respective owners.
