Which strategic actions work?

Automating and improving IT controls rank as the two most consistent strategic actions taken by a majority of the firms with the least loss or theft of sensitive data (Figure 1).

Figure 1: Strategic actions

Source: IT Policy Compliance Group, 2007

Guidance recommendations

Assess the performance results of your firm against the industry benchmark results to determine which additional actions will most help to protect sensitive data.  Use the actions taken by the leaders as a results-guidepost and take the actions that will most improve results for your organization.  These may include:

·       Automating IT controls

·       Improving IT controls

·       Delivering training to employees and managing exceptions to policy

·       Increasing the frequency of measurements and reporting

·       Maintaining an inventory of sensitive data

© IT Policy Compliance Group, 2007