Industry Leading Practices and Self-Regulation

You learned how news stories and public pressure drive government regulations. They also drive many industries to more self-regulation. The hope is to demonstrate to the government and the public that these industries are aware of the problem and are taking action. An industry prefers to self-regulate for two key reasons, cost and flexibility. There’s a perception that regulations increase cost because they can be restrictive and require lots of compliance evidence to be collected. Additionally, regulations can require specific solutions to a problem. Retaining the flexibility to select from an array of solutions and apply new technology is one reason given to avoid regulations. The counterargument is that, without laws, industries won’t fully address problems.

Regardless of your viewpoint on the merits of regulation, the result is that industries create standards over time that may become best practices. The term best practice is commonly understood; however, it can be confusing when trying to understand industry standards. The term is overused and difficult to quantify. What does “best” compare with? Is a simple solution best because it costs the least? Or, is a solution better because it is more reliable? Another term with more precision is leading practice, which is easier to quantify. If most members of an industry adopt a method, it’s considered to be “leading.” It might be the best solution, but that’s not always the case.

NOTE

Most information security professionals belong to associations or regional groups. There are also online communities. These communities share solutions and publish survey results. It’s important to take advantage of this knowledge to understand if you are using leading practices.

Regulated companies look to leading practices as one way to shield themselves from regulators. If regulators have confidence in a leading practice by virtue of adopting it, a company should be confident it is complying with the law. You may not always be able to apply the best solution, but it’s important to be able to tell a regulator that you do conform to industry norms.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.15.219.80