This three-part series highlights 10 common mistakes that organisations make when implementing continuous controls monitoring (CCM) technologies as part of their IT risk and compliance strategies.
On a recent IT compliance project, my client’s management had selected a SaaS product that would continuously monitor and audit their IT and security controls. They’d asked me to provide project management support for its implementation.
Their business case for the project centred on reducing manual methods of auditing IT and security controls and improving visibility into the state of compliance of their technology environment when assessed against their internal IT risk and controls framework.
This project faltered for many reasons, some of which I’ll outline in this article.
What is Continuous Controls Monitoring?
Technology risk managers use continuous controls monitoring (CCM) to reduce the cost of audits by implementing processes and technologies that continuously check IT and security controls for compliance.
By regularly collecting and analysing control telemetry data, CCM can provide actionable intelligence about technology risk. This empowers IT risk and compliance managers with the ability to detect and respond to IT risks and potential compliance failures in a more timely fashion.
The alternative to CCM is to rely on annual IT audits or accreditation cycles that typically use historical data gathered after the fact. This approach is retrospective and is often several steps behind risks that may have already materialised.
Why automate CCM?
Traditional CCM approaches rely on manual, periodic (e.g., weekly, monthly, quarterly), and often tedious data collection from disparate systems and IT personnel for the purpose of auditing and reporting on the effectiveness of IT and security controls.
From my experience, compliance reporting is not a favourite (or priority) task for already-stretched IT and SOC teams.
“Can you share your monthly patch management metrics?” I asked one team lead. “We have other priorities right now, but we’ll get it across to you asap,” he replied.
The data was never received.
The interaction above repeated itself several times with various teams, proving my opinion that control telemetry data can be difficult to obtain (manually) and when collected, can be difficult to validate and interpret by risk and compliance personnel who are operationally removed from the data sources.
The increasingly popular alternative is to introduce partial or full automation i.e., using on-premise or SaaS solutions that connect to multiple IT and security technologies, extract telemetry data, monitor control alignment to targeted IT and security frameworks, and provide real-time insights, alerting, and reporting.
Gartner’s recognition of CCM as a technology risk management product category has seen companies like Panaseer, CyberSaint, and Quod Orbis identified as vendors worth considering. Grandiose vendor claims notwithstanding (‘artificial intelligence’ – I’m looking at you), in a show of confidence, IT risk and compliance departments are coming to these vendors with a growing list of requirements, encouraging further innovation in this solution space.
The truth is that automation is not all that!
CCM automation (or the automation of any process for that matter) is not the “silver bullet” that senior management often thinks it is (or desires it to be).
“If we throw money and software at the problem, all will be solved,” is the very first mistake senior management makes. Unfortunately, vendors who are all too eager to make a sale, often entertain this view and end up promising the impossible, leading to client dissatisfaction.
What follows in part II of this article is a list of 10 mistakes organisations make when implementing CCM automation.
You can read Part 2 and Part 3 of this series here on the blog.
