Almost all, 96 percent, of firms with the least data loss or theft are the exact same firms with the fewest regulatory compliance deficiencies that must be corrected to pass audit (Figure 1)

Figure 1: Firms with the least data loss and theft

Source: IT Policy Compliance Group, 2007

Guidance recommendations

The evidence is in: if you want to protect sensitive data, you have to put in place the same procedures, controls, objectives, and practices that make for successful regulatory audits.

·       Benchmark your own regulatory audit results against the industry

·       Identify your strengths and weaknesses

·       Gather organizational support for making the needed changes to improve results

© IT Policy Compliance Group, 2007