How RegTech Simplifies Governance, Risk, and Compliance
Complying with standards such as HIPAA, PCI DSS, FISMA, and SSAE 16 SOC reporting is complex, costly, and time-consuming, especially for organizations that must comply with multiple standards. You may have heard the term “RegTech” mentioned as a solution. What is RegTech, and how can it help your organization save time, money, and hassle?
RegTech refers to software solutions, usually delivered in the cloud, that automate governance, risk, and compliance processes. Continuum GRC’s proprietary IT Audit Machine (ITAM) is an example of a RegTech software solution. In the finance industry, RegTech is often thought of as a subset of FinTech. However, RegTech has applications in every industry, from healthcare to ecommerce to SaaS and cloud providers.
3 Benefits of Using a RegTech Solution for Compliance
Lower Costs
Perhaps the biggest advantage of implementing a RegTech solution is the cost savings. Compliance is not a business driver; it is a business cost. Not only do RegTech solutions directly save organizations money by eliminating “audit anarchy” and making the compliance process less expensive and more efficient, they also free up internal IT staff to work on projects that benefit the organization’s daily operations and long-term goals, fostering innovation and driving profits.
Greater Insight into Your Data
Many organizations still use Excel and other spreadsheet programs for assessment and audit work. However, Excel performs poorly when used for this purpose; it has limits on space, accessibility, presentation, sustainability and formatting and was not meant to be used to analyze very large, complex data sets. RegTech solutions such as the ITAM eliminate “spreadsheet madness” and organize data to give you clear visibility into your organization’s key risk indicators, assessment results, and compliance initiatives, with integrated reporting of self-assessments, manual assessments, and automated controls.
Peace of Mind
There is a severe shortage of cyber security and compliance professionals. Most organizations simply do not have the in-house expertise to interpret the complex requirements of industry and regulatory standards, particularly since they are continually shifting to respond to the evolving threat environment. For example, the PCI Council just released a 64-page guide updating PCI DSS best practices for ecommerce that stresses, in great technical detail, the upcoming required migration to TLS 1.1+. A RegTech solution cuts through the noise, takes the guesswork out of compliance, and ensures that organizations are always up-to-date with the latest standards, saving you from sleepless nights, wondering if your company is compliant.
RegTech in the “Era of Deregulation”
The recent election of President Donald Trump, whose campaign emphasized deregulation, has caused some experts to question the future of RegTech. However, even in a post-Trump world of relaxed regulations, RegTech will remain relevant. Consider the following:
• The political pendulum will ultimately swing in the other direction. Just as President Trump quickly obliterated many of former President Obama’s policies with the stroke of a pen, the president and Congress who follow Trump could immediately reinstate everything that was abolished during Trump’s administration.
• Individual states may respond to federal deregulation by establishing their own compliance standards, which could end up being more stringent.
• Privately established industry standards will remain in place regardless of what the president or Congress do. For example, PCI DSS is not a piece of legislation. It is a set of standards the major credit card providers require merchants and processors to follow in exchange for the privilege of accepting their cards.
It’s also important to note that RegTech isn’t just about compliance. RegTech solutions have multiple governance and risk management applications that will never lose their relevance, especially in today’s threat environment.
Perhaps most importantly, most compliance standards are, at their core, common-sense cyber security best practices. Your customers want to know that their data is secure, and they will be hesitant to do business with your company if they do not have that assurance. Even if certain data privacy and reporting regulations are officially done away with, many organizations may choose to keep complying with them anyway, simply because their customer base demands it.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.