Are you curious about the concept of trust in cybersecurity?

Jeremy Huval, Chief Innovation Officer at HITRUST, and Robert Booker, Chief Strategy Officer at HITRUST, challenge trust and dive into the world of confidence with cybersecurity, compliance, and risk management leaders in the podcast series Trust vs.

When talking about trust in cybersecurity, we cannot ignore compliance. Compliance is one of the initial steps in establishing trust. David Houlding, Director of Global Healthcare Business Strategy at Microsoft, sheds light on compliance in the first episode, Trust vs. Compliance.

Check out some key insights from the conversation. Tune into your podcast streaming platform to listen to the full episode.

Compliance lays the foundation

Have you wondered why your organization has a particular security program? Most likely, it is due to compliance obligations. When an organization that wants to be PCI compliant realizes it doesn’t have specific controls, it will then implement those controls.

Data security compliance lays the foundation for building a security program. But that’s not enough. Compliance alone cannot protect your organization.

Having said that, the risk of not having data security compliance leads to people resorting to ad hoc techniques such as questionnaires. Are such techniques sufficient in mitigating risk? Absolutely not!

Compliance is the first step toward security. It establishes the standard bar of adequacy and fosters mutual trust.

Assurance adds value to compliance

You’ve completed data security compliance with major frameworks. You’ve implemented the required security controls. But how do you prove that to your stakeholders?

Security assurance adds value to compliance. It allows organizations to assess their security. It helps to earn the trust of key stakeholders such as executive leaders, customers, and regulators. Assurance provides the needed confidence that compliance alone may not.

Compliance in the cloud is a challenge

Every organization, big or small, tends to adopt the cloud to manage its data. When organizations move their data to the cloud, they embark on a long journey. For instance, if a healthcare provider wants to move their electronic health record system to the cloud, it can take them more than a year to complete the migration. Throughout this journey, they must maintain data security compliance to protect data that is both on-premises and on the cloud.

It is a challenge to manage security when working with the cloud. However, shared responsibilities and inheritance can ease the process. The HITRUST Shared Responsibility and Inheritance Program allows organizations to inherit up to 85% of requirements from their cloud service provider’s previous assessments and achieve their security certification goals faster.

Compliance is an ongoing effort

You’ve completed all the steps to be compliant with multiple authoritative sources. But your job is not done yet.

Technologies keep changing. New technology, like AI or blockchain, has made the technological landscape exciting. It helps organizations to provide better services at cheaper rates. However, it comes with security risks. AI can be used in phishing activities or for creating deepfakes.

New threats keep emerging. This makes it necessary to update your compliance, security, and assurance requirements and always stay relevant.

Compliance offers a competitive advantage

You may have noticed organizations rush for compliance after a security breach occurs in the industry. They treat compliance as a reactive approach instead of being proactive.

Organizations see compliance as a burden. Confusion about compliance impedes solution adoption. But compliance offers opportunity. It is a wise investment that gives a competitive edge. And when compliance is supported by security assurance, it helps to earn the trust of stakeholders and opens new business opportunities.

Compliance is a tool that organizations share to keep their clients’ and customers’ data safe. But it is just a part of a program. Organizations need to go beyond meeting minimum compliance standards. When organizations proactively take compliance to the next level with security assurance, they lead the way in earning trust.

To learn more about trust and compliance, check out the full podcast episode.