Compliance risk and security risk are distinct in their definitions but deeply interconnected in their consequences, and the organisation that manages them as separate concerns will consistently find that the gaps between its compliance posture and its security posture are precisely the vulnerabilities that its most consequential incidents arise from. Understanding this relationship, and governing the compliance programme in a way that reflects it, is one of the most important analytical contributions that the GRC framework makes to the organisation’s overall risk management capability.
Compliance risk is the risk of failing to meet the legal, regulatory, contractual, or standards obligations that apply to the organisation’s operations. Its most immediately visible consequences are the legal sanctions, regulatory fines, and contractual penalties that non-compliance attracts. But the compliance risk that is most consequential for the information security practitioner is rarely the regulatory penalty itself. It is the security vulnerability that the compliance failure both signals and creates.
Non-Compliance as a Security Risk Indicator #
The relationship between compliance failure and security vulnerability is not coincidental. Compliance requirements in the information security domain exist because the regulatory and standards bodies that impose them have determined that the controls they require address genuine security risks whose absence creates exposures that the organisations subject to the requirements cannot be trusted to address voluntarily without the regulatory obligation as a forcing function. Non-compliance with data protection regulations does not simply create a regulatory exposure. It signals that the data handling practices and technical controls that protect personal data from unauthorised access, accidental loss, or unlawful processing are inadequate, and that the organisation’s data subjects, customers, and commercial partners face a genuine security risk as a consequence.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
