How to Learn to Love a Security Audit

Sustaining Compliance
How I Learned to Stop Worrying and Love the Security Audit
Sustaining Compliance Page 2

Executive Summary
This research benchmark provides insight and recommendations for all Research Benchmark organizations that are compelled to manage, audit, and report on security- Aberdeen's Research related systems and information for purposes of demonstrating compliance Benchmarks provide an in-with industry regulations, government regulations, industry standards and depth look into process, best practices, or internal policies. By doing so on a more consistent and procedure, methodologies and repeatable basis, Best-in-Class organizations have demonstrated their ability technologies; identify best to lower operational costs, support higher scale, reduce security risks, and practices; and make actionable maintain consistent policies for security and compliance. recommendations
Best-in-Class Performance Aberdeen used the following performance criteria to distinguish Best-in-Class organizations from Industry Average and Laggard organizations: . Decrease in the number of non-compliance incidents, number of security-related incidents, and number of false positives . Decrease in the time required to complete a compliance-related audit . Increase in the number of systems requiring updates, patches, and configuration changes actively being managed, and increase in the number of systems generating logs actively being managed Companies with top performance based on these criteria (on a year-over-year basis) earned Best-in-Class status.
Competitive Maturity Assessment Survey results show that the organizations achieving Best-in-Class "They would ask me, 'are we performance shared several common characteristics, including: compliant?' and I had to say to myself, I don't really know. at . 85% have consistent security and compliance policies three o'clock on Tuesday we . 83% have a responsible executive or team with primary ownership were, but who knows what's for security-related compliance initiatives come along since then, or where our systems may have . 61% regularly review and analyze data from compliance drifted?" management, auditing, and reporting solutions ~Chief Security Officer, Midsize . 83% have enabled update / patch facilities on all appropriate devices Health Services Company . 67% have enabled logging on all appropriate sources . 58% have implemented controls to monitor and verify that policy and regulatory requirements are being satisfied
Required Actions In addition to the specific recommendations in Chapter Three of this report, to achieve Best-in-Class performance organizations should recognize that security and compliance initiatives are a journey, not a destination, and dedicate resources for sustained programs and continuous improvement. © 2007 Aberdeen Group. Telephone: 617 723 7890 www.aberdeen.com Fax: 617 723 7897 Sustaining Compliance Page 3

Table of Contents Executive Summary....................................................................................................... 2 Best-in-Class Performance.....................................................................................2 Competitive Maturity Assessment.......................................................................2 Required Actions...................................................................................................... 2 Chapter One: Benchmarking the Best-in-Class .....................................................4 Business Context ..................................................................................................... 4 Aberdeen's Maturity Class Framework ..............................................................5 The Best-in-Class PACE Framework ..................................................................6 Best-in-Class Strategies...........................................................................................7 Chapter Two: Benchmarking Requirements for Success..................................10 Competitive Assessment......................................................................................11 Capabilities and Enablers......................................................................................13 Process............................................................................................... [download for more]