When I think about consistent high performers, I think about routines, standards, and diligence. Whether I’m thinking about sports or business, individuals or organizations, the highest performers have routines that don’t deviate, unless there is a truly exceptional situation. They hold themselves to high standards, usually higher than their peers. They focus, even obsess, over those routines and standards. That’s what makes them successful.
When I think about routines, standards, and diligence, I think about compliance. Compliance requirements are focused on routines (processes and their controls), standards (key performance indicators and key risk indicators), and the diligence to ensure that everyone is properly following those routines and that the organization is meeting those standards. Not surprisingly, compliance is key when it comes to operating in a digital ecosystem. As a result, we’d expect the Digital Trust Ecosystem Framework (DTEF) to have some aspects focused on compliance.
What Does the DTEF Say?
Within the Direct and Monitor domain, trust factor DM.10 Manage Compliance directly references the importance of compliance with respect to digital trust.1 Within that trust factor there are three practices:
- DM.10.01 Identify Internal Compliance Requirements
- DM.10.02 Identify External Compliance Requirements
- DM.10.03 Implement and Monitor Compliance
While other domains and the trust factors within those domains don’t have compliance included in their titles, compliance does play a role. For instance, within the Architecture domain, the trust factor AR.01 Create Enterprise Trust Architecture cannot be met without proper consideration of compliance requirements. This is a necessity for proper enterprise architecture, after all. The Open Group Architecture Framework (TOGAF), for instance, part of TOGAF’s Architecture Development Method (ADM) contains a phase titled Requirements Management.2 Requirements Management is tied to every other phase in the ADM. While that phase isn’t exclusively focused on compliance requirements, since that phase encompasses all requirements that the solution must adhere to, compliance is included in, and central to, a properly deployed enterprise solution.
Simply put, if one adheres to the DTEF, then one is going to be spending a good deal of effort on compliance. We could continue to talk about why compliance requirements must be met, but let’s shift gears and instead look at why we should want to have and meet compliance requirements. Framing them properly can give our organizations competitive advantages in a digital trust ecosystem.
Guardrails and Speed to Deliver
When a team is starting from scratch, there are many decisions which must be made. This can lead to analysis paralysis: overthinking due to the many options available.3 Analysis paralysis freezes decision making and halts progress toward any effort. Compliance requirements can reduce the number of decisions. For instance, if there is an organizational compliance requirement for data minimization, then what data to collect is immediately limited to what is needed by that system. There are no “what if” questions to be asked because the compliance requirement immediately answers those questions.
Being knowledgeable about compliance requirements can also help decision makers: for instance, if there’s a debate between deploying an application programming interface (API) to sit in front of the data versus creating multiple data marts and distributing them across different servers to support other applications. If there is a data minimization requirement, then the team should immediately choose to implement the API rather than deploying data marts, unless downstream systems cannot work without them. The team needs to be able to explain why before transferring and storing the data any further.4 If there isn’t a sufficient business case, then transfer and storage should not be part of the solution.
If there is less to plan and build, then personnel resources and the time taken to develop the solution should be reduced proportionately. That means features and services are delivered to customers with a reduced total cost of ownership. In the fast-moving digital world, being able to consistently deliver quality solutions and improvements raises the trust in an organization’s brand and ability to execute. Having the available capital to fund such enhancements is critical. Therefore, looking at compliance requirements as guardrails to help define solutions assists an organization’s efforts toward digital trust.
Commercial Acceptance
It is no coincidence that every major cloud service provider has a compliance and certification page listing all the certifications they comply with. Many third-party risk management programs require compliance and certification documentation before the organization is allowed to do business with a particular vendor. For instance, I’ve seen solutions users liked and strongly requested denied because of the lack of System and Organization Controls (SOC) or International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 27001 accreditation.5 The lack of accreditation can be a non-starter for a business relationship.
There are cases where the legal risk is too great to deal with a business partner that lacks the proper compliance credentials. Consider an organization that possesses more relevant accreditations than another, all else being equal. Not unlike hiring practices, if two candidates seem equally strong, the fact that one candidate has certifications and the other doesn’t may decide in favor of the more credentialed candidate. It rarely hurts. For instance, even if I don’t have a requirement that a particular vendor must have a SOC 2 attestation but one vendor does and another does not, I’ll have a greater sense of trust and assurance with the vendor whose processes and controls are reviewed by an external third party, and from whom I can request the most recent audit report.
In the fast-moving digital world, being able to consistently deliver quality solutions and improvements raises the trust in an organization’s brand and ability to execute.Consistent Performance
Inconsistent performance does not engender trust. To use a sports analogy, a baseball pitcher who can throw the ball extremely hard but lacks refinement may be able to make it to the highest levels of baseball, but he will not remain there. For instance, when a young Randy Johnson reached out to Nolan Ryan, both now Hall of Fame pitchers, Ryan’s advice was to work on consistency: “He stressed that I had to develop consistency with my arm angle and mechanics before I could be successful.”6
From a business perspective, the importance of compliance to performance is summed up well in this statement: “Good internal compliance measures provide clear guidelines for the company on how it should operate, and what things team members can and cannot do.”7 Such clear guidelines help an organization stay on task with what’s most important for its success. If compliance is prioritized, then consistency is achieved. Solid performance—excellence—means the organization gains a reputation for being able to deliver on expectations. Such organizations will gain opportunities and strengthen relationships. Not coincidentally, large organizations with rock-solid performance attract investors and are referred to as blue chip stocks.8 While I don’t think there’s a term or phrase in the digital trust ecosystem comparable to “blue chip stock,” this is the type of recognition an organization should desire to achieve in the digital space.
Compliance and Digital Trust Go Hand in Hand
While there are many ways compliance can fuel trust for an organization, let’s recap the three discussed here. Focusing on compliance provides well-defined guardrails that can speed up the delivery of solutions and reduce overall cost. In today’s digital ecosystem, delivering working features and services quickly and regularly increases an organization’s trust in the ecosystem. Compliance can also lead to business opportunities: Organizations seek out partners who have proper accreditations, both to avoid legal liabilities and also because they can verify the partner has the relevant controls in place, increasing trust in said partner. Finally, well-designed and adhered-to internal compliance measures should ensure consistent, solid performance by an organization. Consistent excellent performers appeal to those looking for business partners. Therefore, if an organization wants a solid reputation in a digital trust ecosystem—if the organization wants to be seen as a trustworthy entity—then compliance can help drive the organization towards those goals.
Endnotes
1 ISACA®, Digital Trust Ecosystem Framework, 2024
2 The Open Group, The TOGAF Standard, Version 9.2
3 Carmichael, M.; “Do You Overthink? How to Avoid Analysis Paralysis in Decision Making,” ISACA, 6 March 2024
4 Raghu, R.V.; “Data Minimization: An Approach to Data Governance,” ISACA, 20 December 2021
5 Secureframe, “SOC 2 Controls List: What Controls Do You Need to Implement?”; International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC), Joint Technical Committee on Information Technology (ISO/IEC JTC 1), ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection―Information security management systems―Requirements, Edition 3, 2022
6 Pinak, P.; “A Young Randy Johnson Turned His MLB Career Around Thanks to Nolan Ryan’s Advice,” FanBuzz, 3 March 2023
7 Vitasek, K.; “Why Compliance Is Important For Building (And Maintaining) Strong Business Partnerships,” Forbes, 20 March 2024
8 Chen, J.; “What Are Blue Chip Stocks and Are They Good Investments?,” Investopedia, 14 May 2024
K. BRIAN KELLEY | CISA, CDPSE, CSPO, MCSE, SECURITY+
Is an author and columnist focusing primarily on Microsoft SQL Server and Windows security. He currently serves as a data architect and an independent infrastructure/security architect concentrating on Active Directory, SQL Server, and Windows Server. He has served in a myriad of other positions, including senior database administrator, data warehouse architect, web developer, incident response team lead, and project manager. Kelley has spoken at 24 Hours of PASS, IT/Dev Connections, SQLConnections, the TechnoSecurity and Forensics Investigation Conference, the IT GRC Forum, SyntaxCon, and for various SQL Saturdays, Code Camps, and user groups.