Pragmatic Risk-Based Approach to Cybersecurity: Establishing a Risk-Enhanced Unified Set of Security Controls

Why Compliant Does Not Mean Secure

Compliance guidelines are provided as a generalized method to define common minimum standards for a specific area of concern such as payment industry, healthcare, financial information and so on. Given the high degree of interpretation that each guideline is subject to, any blind strict adherence will not result in any material improvements in security or operations. There are many factors that can still cause a security failure despite an organization's adherence to the standard. Lack of skilled staff, human error, availability of information to support breach detection, dysfunctional organizational structures are all contributors to bad security despite meeting the compliance standards.

Establishing a framework is a very complicated undertaking. As Table 1 suggests, most frameworks are updated in regular intervals, yet keeping up with the pace and implementation of certain updates can be challenging.