Compliance: Stay ahead of the game

No industry or organisation is untouched by compliance. Whether it's employment law, data protection or more notorious pieces of legislation, such as Sarbanes-Oxley, the way companies and their employees behave and conduct business is under ever greater scrutiny. It's no longer enough just to say that everything is being done correctly - now you have to prove it.

How organisations do this varies, as you might expect. Some bury their collective heads in the sand, but others are facing facts and are at least looking at their compliance responsibilities. Some are even buying information technology in an effort to make themselves compliant.

However, as almost every consultant will tell you, compliance is more about process than anything else - technology, if it comes into play at all, comes much, much later. "Compliance, almost by definition, is about process. Technology just automates the process," said Steven Cox, principal consultant at CA.

So, from the outset, the first step for any organisation is simply finding out what they have to do to be compliant and what they need to be compliant with. Most pieces of compliance legislation talk about "protection of end-user data" and the prevention of data loss, but few discuss details, according to Andy Green, security solutions specialist at support services group Alfred McAlpine.

Depending on the sector, there are some clear first stops for information, such as the industry regulator itself. The Information Commissioner will offer advice on Freedom of Information Act compliance, for example, while the Financial Services Authority offers guidance on complying with its many rules and regulations.

However, for more detailed information, particularly with regard to IT systems, bodies such as the International Security Forum (ISF) can provide advice to its members.

"The ISF has a database of all the laws in all the countries around the world," said Dave Martin, lead security consultant at LogicaCMG. "It is maintained by its members around the world. It's one of the best sources I've seen." He warns that few of the members are lawyers, so anyone consulting the database should also check with their legal department before acting on any information.