Security: Compliance is Expensive, but Ultimately Saves Money

The average cost of security compliance for a company is $3.5 million.   That sounds high.  But a study by the Ponemon Institute found that companies that haven’t made the upfront investment in security compliance end up on average paying three times more on security-related problems that they run into.

Larry Ponemon, chairman and founder of the Ponemon Institute, said that “most organizations are probably underfunding their compliance activities and they’re not measuring their non-compliance costs effectively.  They don’t really understand that if they did a better job on compliance, it can lead to a lower total cost of compliance.”

The Ponemon study looked at the impacts of compliance costs and benefits as related to compliance regulations and standards.  They considered the payment card industry’s PCI-DSS standard and also HIPAA, European Union Privacy Directive, and Sarbanes-Oxley.  The report recommends that when implementing compliance, organizations especially focus on meeting requirements for security compliance.

Ponemon assigned a security effectiveness score (SES) to organizations to measure how well they have implemented security measures within their company.   Organizations with high scores for SES typically had lower costs related to security non-compliance.  The report found that organizations that spent more on security compliance typically had smaller costs associated with non-compliance.

Rekha Shenoy, vice president of strategy for Tripwire, the sponsor of the Ponemon report, said that  “Organisations today are confronted by a growing number of compliance challenges and it can be extremely difficult from a resource perspective to address these concurrently.  However, businesses that invest in continuous monitoring and conduct frequent audits can drastically reduce the business and financial consequences associated with non-compliance. ..  There are not many differences among industries. They are all spending money for compliance, but they are not all getting secure.  It was the ones that invested in security practices that were reaping the benefits — those that focused on securing the business, rather than focusing on compliance alone…  ”

Shenoy said that  “the difference between companies that are improving and those that have a wider gap is likely executive leadership.  We see the common thread being the number of internal audits occurring—which happens with executive support. So when the compliance dollars go toward investing in automated compliance and good security practices, the business reaps the benefits.”