Compliance activities and fines cost organizations nearly $4m per year

Telos Corporation, provider of cyber, cloud and enterprise security solutions, unveiled new findings from a survey conducted by independent research firm Vanson Bourne that highlights organizations’ ongoing struggle to keep up with IT security and privacy compliance regulations. The survey, which polled 300 IT security professionals in July and August 2020, revealed that, on average, organizations must comply with 13 different IT security and/or privacy regulations and spend $3.5M annually on compliance activities, with compliance audits consuming 58 working days each quarter.

As more regulations come into existence and more organizations migrate their critical systems, applications and infrastructure to the cloud, the risk of non-compliance and associated impact increases. Key findings from the survey include:

IT security professionals report receiving an average of over 17 audit evidence requests each quarter and spend an average of three working days responding to a single request
Over the last 24 months, organizations have been found non-compliant an average of six times by both internal and third party auditors resulting in an average of eight fines, costing an average of $460,000
Nearly nine in 10 organizations (86%) believe compliance would be an issue when moving systems, applications and infrastructure to the cloud
94% of organizations report they would face challenges when it comes to IT security compliance and/or privacy regulations in the cloud

“Compliance teams spend 232 working days each year responding to audit evidence requests, in addition to the millions of dollars spent on compliance activities and fines,” said Dr. Ed Amoroso, CEO of TAG Cyber, a global cyber security advisory, training, consulting, and media services company. “The bottom line is this level of financial and time commitment is unsustainable in the long run.”

“As hammer, chisel and stone gave way to clipboard, paper and pencil, it’s time for organizations to realize the days of spreadsheets for ‘checkbox compliance’ are woefully outdated,” said Steve Horvath, vice president of strategy and cloud at Telos. “Automation can solve numerous compliance challenges, as the data shows. It’s the only real way to get in front of curve, rather than continuing to try and keep up.”

Nearly all survey respondents (99%) indicated their organization would benefit from automating IT security and/or privacy compliance activities, citing expected benefits such as increased accuracy of evidence (54%), reduced time spent being audited (51%) and the ability to respond to audit evidence requests more quickly (50%).

For additional findings and to download the full report, visit: www.telos.com/reserved/audit-fatigue-report/

ON DEMAND: Business-impacting events such as severe weather, man-made disasters, and supply chain disruption are increasing in frequency and making impacts around the globe.

In today's rapidly evolving security landscape, organizations face an ever-growing array of disruptive events, security threats and risks. Traditional reactive approaches to security intelligence often leave businesses vulnerable and ill-prepared to anticipate and mitigate emerging threats that could impact the safety of their people, facilities or operations.