IT Compliance Management

IT Governance Necessary

IT Governance has evolved from a concept to a business realty. Today’s competitive, dynamic global marketplace makes it imperative for organizations to harness IT to achieve product differentiation, superior customer service and cost-effectiveness. Since most of a company’s critical business functions are supported in some way by IT, it is essential that IT is governed according to the needs of the business and that risk exposure associated with each crucial business function is well understood and actively managed.

To assist organizations in deploying IT Governance procedures and policies, several standard frameworks have been created over the previous 20 years:

CoBIT – Standard for Best Practices with IT Risk Assessment

Control Objectives for IT (CoBIT) is one approach to standardize good Information Technology security and control practices. This is done by providing tools to assess and measure the performance of 34 different IT processes within an organization. The IT Governance Institute is responsible for CoBIT. The IT Infrastructure Library (ITIL) processes support many of the CoBIT Control Objectives.

ISO 27001 and ISO 27002 (formerly ISO 17799) – Best Practices for Information Security

The ISO/IEC 27000-series, specifically ISO/IEC 27001 and ISO/IEC 27002 (formerly numbered ISO/IEC 17799), is a set of best practices for organizations to follow to implement and maintain a security program. It started out as British Standard 7799 (BS7799), which was published in the United Kingdom and became a well known standard in the industry that was used to provide guidance to organizations in the practice of information security.

ITIL Adoption for IT Governance by Companies Worldwide

The IT Infrastructure Library (ITIL) originated in the public sector in Great Britain in the 1980s as a framework of standards for IT services. ITIL continues to be widely adopted across the world by organizations of all sizes and industries. Forrester Research has estimated that ITIL adoption among billion-dollar companies will increase to 40 percent in 2006, and reach 80 percent by 2008.

PCI DSS – Credit Card Security Compliance for Retailers, Web Vendors

PCI DSS, or the Payment Card Industry Data Security Standard was developed by five major credit card companies as a guideline to help financial institutions, Internet vendors and retail merchants prevent credit card fraud, hacking and various other security vulnerabilities and threats. A company processing, storing, or transmitting payment card data must be PCI DSS compliant, or risk losing their ability to process credit card payments, being audited and/or they will be fined. Merchants and payment card service providers must validate their compliance periodically.