Future-Proof from the Start: The Power of Consolidated Compliance

Consolidated compliance is something security and compliance leaders often start contemplating once they're managing a substantial number of compliance frameworks.  It’s something leaders put off until they really start to feel scale challenges.  But why wait?

Given the vast number of compliance frameworks currently in use and the ongoing regulatory scrutiny, it’s unlikely that an organization will have to comply with only one framework.  Instead, organizations should anticipate growing demands for additional compliance.  Leaders should start planning for the future now.   Implementing a consolidated compliance approach from the outset can future-proof a compliance program for scale.  In this article, we’ll discuss what consolidated compliance is, its benefits, and how organizations can take simple steps to embrace this approach from the start.

What is Consolidated Compliance?

Before describing consolidated compliance.  Let’s describe what it is not.  It’s not about managing compliance on a per-framework basis.  It’s not running separate audits by framework.  And it’s not having one set of requirements in your security policy and another being managed by the compliance team.  These are the antithesis of consolidated compliance and result in rework, increased operational costs, and, probably, a healthy dose of frustration from control owners.

Alternatively, organizations can adopt a consolidated compliance approach.  In this approach, organizations define a single set of organizational controls to manage their security and compliance program.  We’ll refer to the organizational controls as a Common Controls Framework (CCF), which are at the center of a consolidated compliance approach. Requirements from specific compliance frameworks are mapped to organizational controls, along with those from internal security policies.  Compliance management is performed holistically using the organizational requirements to drive control design, monitoring, attestations, and external audits.  Note: Establishing a CCF does not inherently mean that an organization’s implementation of controls (across products or across infrastructure) has been rationalized to streamline control implementations.  This is an additional step that organizations can take to further simplify and streamline control implementation and maintenance.

Benefits of a Consolidated Compliance Approach

Organizations that adopt a consolidated compliance approach do so with these goals in mind:

• Rationalizing compliance management: The security and compliance team is looking to manage a single set of controls (CCF) rather than managing controls across multiple compliance frameworks and internal security requirements.  To do this, the organization can maintain a mapping of framework-specific requirements to the CCF.  Compliance management can then be streamlined, including internal control monitoring processes, control attestations, and linking controls with risks and issues. These can all be performed using the CCF rather than managing them on a per-framework basis.

• Streamlining control design and operations: Control owners want to design, operate, and monitor a single set of controls (CCF) rather than managing and implementing requirements from multiple compliance frameworks and internal security requirements.  This simplifies communication between the compliance team and control owners and allows control owners to focus on implementing robust controls that mitigate risk and hold up across multiple frameworks.

• Enabling evidence reuse: Control owners and the compliance team want to minimize the generation of redundant control evidence. When controls are mapped across frameworks, audit evidence can be reused for internal testing of controls or external audits.  There are some nuances to evidence reuse, including the evidence coverage period, sampling selections across auditors (if applicable), and evidence age requirements that need to be determined.  But once successfully navigated, this can reduce redundant evidence requests from compliance teams to control owners.

• Reducing external audit overhead: Organizations want to minimize the impact of external audits so teams can focus on product and feature capabilities. One way to do this is to take a “test once, comply many " approach and work with auditors who can perform consolidated audits across frameworks.  The impact of such a change is to consolidate the number of audit cycles an organization needs to undergo, rather than performing audits on a per-framework basis.  Such a change can significantly reduce the overall effort required for audit walkthroughs and evidence collection for control owners and compliance team members.

• Simplifying intake for new frameworks: Organizations facing demand for new compliance frameworks want to accelerate evaluation to pave the way for implementation. To enable this, requirements from new frameworks can first be mapped to the CCF, and then a gap assessment can be conducted against any outlier controls.  This streamlines the readiness process and allows organizations to more easily see the coverage they have across various frameworks from their existing controls. Framework-specific nuances should always be reviewed to ensure the CCF fully covers the new framework requirements.

Collectively, these goals focus on taking a proactive approach to managing compliance and, in turn, organizational risk, while reducing rework for control owners and compliance teams.

Simple Steps to get Started

To adopt a consolidated compliance approach for your organization, here are five simple steps to get started.

1. Determine the basis for your CCF: Decide what you want as the basis for your organizational controls (CCF).  Are these self-defined? Are you using a control framework? Or are you leveraging a third-party CCF, perhaps one already integrated into your GRC (Governance, Risk, and Compliance) tool?

2. Perform/Validate Initial Mapping: Map your in-scope compliance frameworks and security policy requirements to the CCF and update and tailor accordingly.

3. Operationalize CCF: Use CCF as the basis for your compliance management activities, including control design, attestations, testing, and monitoring.  

4. Auditor Selection: Select an auditor that can perform a consolidated audit against your in-scope compliance frameworks.

5. Maintain CCF: Regularly update the CCF to keep it current as external frameworks, internal security policies, and the control environment are updated.  It’s imperative that the CCF be a living framework that accurately reflects requirements and controls for your organization.

Common Pitfalls

A consolidated compliance approach with CCF at its center can be a powerful resource for future-proofing an organization’s GRC program for scale.  But if not maintained and integrated into operational processes, it can quickly become obsolete and shelfware.  Help your organization avoid these pitfalls:

• Planning - Spend additional time planning compliance operations and external audits using CCF.  If time isn’t invested here, compliance team members and auditors may resort to familiar habits using specific frameworks.

• Maintenance - Keep CCF current.  Update it regularly to ensure it accurately reflects external requirements and your internal control environment.  The accuracy of the framework is key to its usability.

• Validate Mappings - Whether you did the mapping yourself or are using a third-party mapping, it’s important to review and validate the mapping of requirements to ensure they accurately reflect the framework's requirements and nuances relevant to your organization.  

No Time Like the Present to Start Future-Proofing Your Program

With the current trend toward industry and country-specific compliance frameworks, the number of frameworks your organization needs to comply with is likely to keep increasing.  Leaders can plan for scale or retrofit later.  But why wait?  Implementing a consolidated compliance approach from the start can future-proof the program for the inevitable scale and complexity that lies ahead.  

---

​Ready to future-proof your compliance program?   Connect with our GRC expert advisor to learn more.