At the most basic level, there is no single standardized framework or terminology that explicitly defines what your organization must do for compliance. Instead, there are many frameworks with conflicting requirements. Terminology is often vague or interpreted differently within organizations and between geographic regions. Ambiguity abounds due to lack of a universal philosophy of compliance. A big challenge for security professionals is navigating this ambiguity, especially when financial auditing terms such as Governance, Risk and Compliance (GRC) are loosely applied to IT security solutions. Let the buyer beware! This guide describes seven typical mistakes of IT security compliance and how you can use these lessons to help your organization achieve its compliance goals.

1) Decentralized Policy ManagementMany companies, especially global organizations have had multiple silos of policy content that evolved over time without the benefit of a common compliance framework, terminology and definitions. Consequently, different regions in an organization have different policies that do not conform to a unified standard. For example, a risk score might be calculated one way in the EU and another in the US, which complicates consistent documentation of compliance. It’s not expected that every region would share identical policies, especially since regulatory requirements for one area often differ substantially from another. But when regional policies are developed in a vacuum, it increases the cost of an enterprise compliance program.