1
00:00:06,570 --> 00:00:08,160
- Welcome to lesson 26.

2
00:00:08,160 --> 00:00:11,490
Summarize the elements of
effective security compliance.

3
00:00:11,490 --> 00:00:14,340
In lesson 26.1, we're gonna focus in

4
00:00:14,340 --> 00:00:16,113
on compliance monitoring.

5
00:00:17,460 --> 00:00:20,970
Now, as a refresher compliance
means acting in accordance

6
00:00:20,970 --> 00:00:25,970
with applicable rules, laws,
policies and or obligations.

7
00:00:25,980 --> 00:00:28,170
And that organizations are responsible

8
00:00:28,170 --> 00:00:30,990
for complying with all
local, state, federal

9
00:00:30,990 --> 00:00:32,610
and union laws and regulations.

10
00:00:32,610 --> 00:00:34,740
And by union, I mean union
of states or countries

11
00:00:34,740 --> 00:00:37,920
like the European Union or
the European Economic Area,

12
00:00:37,920 --> 00:00:40,530
international agreements
and treaties, as well

13
00:00:40,530 --> 00:00:44,010
as organizational agreements
and contractual obligations.

14
00:00:44,010 --> 00:00:46,560
And additionally,
considerations should be given

15
00:00:46,560 --> 00:00:49,980
to local customs, traditions and practices

16
00:00:49,980 --> 00:00:52,773
be they cultural, tribal or religious.

17
00:00:54,270 --> 00:00:56,970
Jurisdiction being the power or the right

18
00:00:56,970 --> 00:01:01,440
of a legal or political agency
to exercise its authority

19
00:01:01,440 --> 00:01:04,920
over a person, a subject
matter or a territory.

20
00:01:04,920 --> 00:01:07,353
And we talked earlier about jurisdiction.

21
00:01:08,310 --> 00:01:10,410
Now in relation to cyber,

22
00:01:10,410 --> 00:01:13,170
if you remember jurisdiction
pertains to the location

23
00:01:13,170 --> 00:01:16,290
of data and systems in all
of its states, processing,

24
00:01:16,290 --> 00:01:18,030
transmission and storage.

25
00:01:18,030 --> 00:01:21,930
The type of data, is it
personally identifiable data?

26
00:01:21,930 --> 00:01:23,010
Is it financial data?

27
00:01:23,010 --> 00:01:24,390
Is it healthcare data?

28
00:01:24,390 --> 00:01:25,620
Is it educational data?

29
00:01:25,620 --> 00:01:29,670
Is it data that belongs to
a minor under the age of 13?

30
00:01:29,670 --> 00:01:31,920
The residents of the data owners

31
00:01:31,920 --> 00:01:34,290
and the residents of the data subjects.

32
00:01:34,290 --> 00:01:38,700
And it's really incumbent upon
an organization to know all

33
00:01:38,700 --> 00:01:40,200
of their applicable jurisdictions.

34
00:01:40,200 --> 00:01:41,430
So you wanna be able to document

35
00:01:41,430 --> 00:01:44,630
all your applicable
jurisdictions, including location,

36
00:01:44,630 --> 00:01:46,980
resonance and data sets.

37
00:01:46,980 --> 00:01:48,975
And this is a fantastic
whiteboard exercise

38
00:01:48,975 --> 00:01:52,200
although it's many more
than one whiteboard, right?

39
00:01:52,200 --> 00:01:54,330
You may have a whole
room full of whiteboards,

40
00:01:54,330 --> 00:01:57,630
but you wanna do this like now
if you haven't already done

41
00:01:57,630 --> 00:02:01,110
this in an organization
because you need to know, right

42
00:02:01,110 --> 00:02:03,699
what your jurisdictions
are so you know what laws

43
00:02:03,699 --> 00:02:06,843
and rules and regulations
you have to comply with.

44
00:02:10,440 --> 00:02:13,920
So what is the consequence
of not knowing or knowing,

45
00:02:13,920 --> 00:02:15,330
but not complying?

46
00:02:15,330 --> 00:02:17,362
Well, could be fines, sanctions,

47
00:02:17,362 --> 00:02:20,996
resource utilization
issues, a loss of a license,

48
00:02:20,996 --> 00:02:24,690
contractual impact or reputational damage.

49
00:02:24,690 --> 00:02:26,130
There could be fines that are levied

50
00:02:26,130 --> 00:02:29,160
by a regulatory agency or by a court.

51
00:02:29,160 --> 00:02:32,580
In worst case scenario,
potential jail time.

52
00:02:32,580 --> 00:02:34,740
There could be sanctions that are opposed

53
00:02:34,740 --> 00:02:37,353
by the regulatory agency or by a court.

54
00:02:38,730 --> 00:02:42,349
You may have to reallocate
resources to address issues

55
00:02:42,349 --> 00:02:46,260
and the issues take much longer,
like to address or to fix.

56
00:02:46,260 --> 00:02:49,053
And if you had just done the
right thing to begin with.

57
00:02:50,190 --> 00:02:54,576
You might lose an operating
license, a permit or a charter.

58
00:02:54,576 --> 00:02:58,530
You may have penalties
or relationship damage

59
00:02:58,530 --> 00:03:02,640
or loss of trust from those
that you have contracts with.

60
00:03:02,640 --> 00:03:05,340
And you'll definitely
have reputational damage,

61
00:03:05,340 --> 00:03:08,793
which is loss of stakeholder
trust and respect.

62
00:03:10,560 --> 00:03:13,830
So compliance monitoring
is the active process

63
00:03:13,830 --> 00:03:16,620
of evaluating our
activities, our practices

64
00:03:16,620 --> 00:03:19,629
and our behaviors to verify compliance

65
00:03:19,629 --> 00:03:24,379
and then to proactively
identify any deviations

66
00:03:24,379 --> 00:03:26,760
or non-compliant actions.

67
00:03:26,760 --> 00:03:29,640
Now, there's already been these
deviations or non-compliant,

68
00:03:29,640 --> 00:03:31,680
but we wanna recognize this, right?

69
00:03:31,680 --> 00:03:33,990
We wanna find them in our own organization

70
00:03:33,990 --> 00:03:38,990
and fix it before perhaps a
regulatory agency identifies it

71
00:03:39,210 --> 00:03:41,493
or there's any other consequence.

72
00:03:43,140 --> 00:03:46,500
Now, compliance monitoring
is used to identify areas

73
00:03:46,500 --> 00:03:48,480
for improvement as well

74
00:03:48,480 --> 00:03:51,870
and enables early detection
of non-compliance.

75
00:03:51,870 --> 00:03:53,520
So how do we monitor?

76
00:03:53,520 --> 00:03:56,460
Well, monitoring activities
include manual inspections,

77
00:03:56,460 --> 00:04:00,300
audits, data analysis, automated systems,

78
00:04:00,300 --> 00:04:03,333
a favorite or specialized tools.

79
00:04:04,530 --> 00:04:07,410
So let's talk about automated
compliance monitoring.

80
00:04:07,410 --> 00:04:11,084
Automated compliance monitoring
utilizes automated tools

81
00:04:11,084 --> 00:04:14,847
to monitor and to assess compliance.

82
00:04:14,847 --> 00:04:18,330
Now, what's the benefit
of an automated system?

83
00:04:18,330 --> 00:04:21,690
Well, automated systems
can analyze large volumes

84
00:04:21,690 --> 00:04:26,046
of data in real time, right to
identify patterns, anomalies

85
00:04:26,046 --> 00:04:29,730
or potential compliance breaches.

86
00:04:29,730 --> 00:04:32,160
Now, automated systems
can also be programmed

87
00:04:32,160 --> 00:04:36,270
to generate alerts or notifications
when specific conditions

88
00:04:36,270 --> 00:04:37,923
or thresholds are met.

89
00:04:38,970 --> 00:04:41,670
Automation also has a good audit trail

90
00:04:41,670 --> 00:04:45,120
so it can help maintain those
audit trail documentation

91
00:04:45,120 --> 00:04:48,210
that you're gonna need
for compliance purposes.

92
00:04:48,210 --> 00:04:51,633
And automated tools can
monitor regulatory changes

93
00:04:51,633 --> 00:04:54,150
and updates in real time.

94
00:04:54,150 --> 00:04:56,280
So what else are you supposed to be doing?

95
00:04:56,280 --> 00:04:58,530
And those of you who are
in regulated industries

96
00:04:58,530 --> 00:05:02,403
you know that regulations
change fairly frequently.

97
00:05:05,010 --> 00:05:09,210
So how do you know if you
are baseline controls really

98
00:05:09,210 --> 00:05:13,003
are in compliance with
all of your obligations?

99
00:05:13,003 --> 00:05:15,180
Well, you wanna undertake what's known

100
00:05:15,180 --> 00:05:19,645
as a baseline modification
process, which really is this.

101
00:05:19,645 --> 00:05:21,420
We're gonna establish a criteria.

102
00:05:21,420 --> 00:05:22,800
We need to say, okay

103
00:05:22,800 --> 00:05:25,050
what regulatory requirements do we have?

104
00:05:25,050 --> 00:05:27,120
What are we supposed to be doing?

105
00:05:27,120 --> 00:05:29,490
We're gonna engage in
monitoring activities

106
00:05:29,490 --> 00:05:30,840
that could be automated monitoring

107
00:05:30,840 --> 00:05:34,041
like we just spoke about,
or manual monitoring.

108
00:05:34,041 --> 00:05:36,720
That'll allow us to gather data.

109
00:05:36,720 --> 00:05:37,950
Are we in compliance?

110
00:05:37,950 --> 00:05:39,083
Are we not in compliance?

111
00:05:39,083 --> 00:05:40,380
Are we close?

112
00:05:40,380 --> 00:05:42,033
Are we really far off?

113
00:05:43,350 --> 00:05:46,867
We'll, then be able to assess
what we need to be doing

114
00:05:46,867 --> 00:05:51,240
and identify any non-compliance activities

115
00:05:51,240 --> 00:05:54,690
that we are engaged in or things
that we're just not doing.

116
00:05:54,690 --> 00:05:57,990
So issues by omission, just
things we're not taken care

117
00:05:57,990 --> 00:06:00,330
of or things that we should be doing.

118
00:06:00,330 --> 00:06:02,310
And then we're gonna
take corrective action

119
00:06:02,310 --> 00:06:04,263
because we wanna be in compliance.

120
00:06:05,190 --> 00:06:09,600
We should document all
of this and then report.

121
00:06:09,600 --> 00:06:11,280
Now, report out as applicable.

122
00:06:11,280 --> 00:06:13,740
It's always good to
document what you found

123
00:06:13,740 --> 00:06:16,290
and then report as to what you did.

124
00:06:16,290 --> 00:06:18,510
Now, particularly for compliance, because

125
00:06:18,510 --> 00:06:21,630
if a regulatory agency or
anyone who's assessing you

126
00:06:21,630 --> 00:06:24,180
or auditing you or examining
you comes in and says, well

127
00:06:24,180 --> 00:06:27,360
you're not doing the right
thing, it always works better

128
00:06:27,360 --> 00:06:29,490
if you can say, yes, we found that.

129
00:06:29,490 --> 00:06:30,540
We recognize that.

130
00:06:30,540 --> 00:06:31,920
Here's what we know we didn't do.

131
00:06:31,920 --> 00:06:34,342
Here's what we know we
need to do and here's how

132
00:06:34,342 --> 00:06:38,220
we're changing our system
to meet those requirements.

133
00:06:38,220 --> 00:06:40,890
And that would be how we would
do a baseline modification

134
00:06:40,890 --> 00:06:42,183
for compliance.

135
00:06:43,680 --> 00:06:44,820
All right, that my friends

136
00:06:44,820 --> 00:06:46,620
brings us to a three-second challenge,

137
00:06:46,620 --> 00:06:49,023
five challenge questions,
three seconds each.

138
00:06:50,490 --> 00:06:53,557
A monetary penalty levied by
a regulatory agency or court.

139
00:06:53,557 --> 00:06:56,313
One, two, three.

140
00:06:57,660 --> 00:06:59,190
That's gonna be a fine.

141
00:06:59,190 --> 00:07:01,080
Number two, acting in accordance

142
00:07:01,080 --> 00:07:05,310
with applicable rules, laws,
policies and or obligations.

143
00:07:05,310 --> 00:07:06,570
Oh, this is an easy one.

144
00:07:06,570 --> 00:07:07,713
One, two, three.

145
00:07:08,820 --> 00:07:10,680
That's compliance.

146
00:07:10,680 --> 00:07:12,510
Number three, activity used

147
00:07:12,510 --> 00:07:15,420
for early detection of non-compliance.

148
00:07:15,420 --> 00:07:16,983
One, two, three.

149
00:07:18,240 --> 00:07:20,140
That's gonna be compliance monitoring.

150
00:07:21,930 --> 00:07:24,690
Number four, term used
to describe processes

151
00:07:24,690 --> 00:07:28,973
or operations that require
minimal or no human intervention.

152
00:07:28,973 --> 00:07:32,070
One, two, three.

153
00:07:32,070 --> 00:07:34,961
We've used this term a lot in this course.

154
00:07:34,961 --> 00:07:37,380
That's gonna be automation.

155
00:07:37,380 --> 00:07:41,250
And lastly, number five, the
power or right of a legal

156
00:07:41,250 --> 00:07:45,210
or political agency to exercise
its authority over a person

157
00:07:45,210 --> 00:07:48,420
a subject matter or a territory.

158
00:07:48,420 --> 00:07:49,713
One, two, three.

159
00:07:50,610 --> 00:07:52,590
That's gonna be jurisdiction.

160
00:07:52,590 --> 00:07:54,630
Right, that brings us
to a security-in-action.

161
00:07:54,630 --> 00:07:56,823
This one is about compliance monitoring.

162
00:07:57,930 --> 00:08:00,630
The credit union you work
at recently underwent

163
00:08:00,630 --> 00:08:03,895
a compliance exam and there
were numerous findings

164
00:08:03,895 --> 00:08:06,120
and the examiners were requiring

165
00:08:06,120 --> 00:08:07,800
that the credit union enhance

166
00:08:07,800 --> 00:08:10,920
their compliance monitoring processes.

167
00:08:10,920 --> 00:08:13,170
Now, the organization's really small,

168
00:08:13,170 --> 00:08:15,360
current staff is overburdened

169
00:08:15,360 --> 00:08:18,960
and hiring more staff is a challenge.

170
00:08:18,960 --> 00:08:20,859
So you suggest automation.

171
00:08:20,859 --> 00:08:24,630
The CEO asks you to explain the benefits

172
00:08:24,630 --> 00:08:27,630
of an automated compliance
monitoring system.

173
00:08:27,630 --> 00:08:28,780
What are you gonna say?

174
00:08:29,724 --> 00:08:31,950
So you work at a credit union,

175
00:08:31,950 --> 00:08:35,250
you just had a compliance
exam by your regulators.

176
00:08:35,250 --> 00:08:37,770
There were numerous findings.

177
00:08:37,770 --> 00:08:40,500
The examiner say you
really have to do better

178
00:08:40,500 --> 00:08:43,590
at monitoring your compliance,

179
00:08:43,590 --> 00:08:45,540
but the organization's very small.

180
00:08:45,540 --> 00:08:48,210
Your current staff already overburdened.

181
00:08:48,210 --> 00:08:51,750
And hiring more staff these
days is really a challenge.

182
00:08:51,750 --> 00:08:55,710
So no expectation you're gonna
be able to add to your staff.

183
00:08:55,710 --> 00:08:57,990
So you say, okay, well,
we can't add to the staff,

184
00:08:57,990 --> 00:09:00,720
but we have to respond to our regulators.

185
00:09:00,720 --> 00:09:02,610
How about automation?

186
00:09:02,610 --> 00:09:05,850
And the CEO says, okay,
well, lets sit down.

187
00:09:05,850 --> 00:09:07,590
Explain to me the benefits

188
00:09:07,590 --> 00:09:09,720
of automated compliance monitoring.

189
00:09:09,720 --> 00:09:11,100
What are you gonna say?

190
00:09:11,100 --> 00:09:12,510
So go ahead and put me on pause,

191
00:09:12,510 --> 00:09:14,463
jot down some notes about automation.

192
00:09:18,090 --> 00:09:20,250
Well, automation has several benefits

193
00:09:20,250 --> 00:09:22,680
and here are just a few.

194
00:09:22,680 --> 00:09:25,590
Automation reduces manual efforts,

195
00:09:25,590 --> 00:09:29,040
eliminates repetitive tasks
and can handle volumes

196
00:09:29,040 --> 00:09:32,433
of data freeing up resources
for other activities.

197
00:09:33,750 --> 00:09:37,290
Automation monitoring
processes are consistent

198
00:09:37,290 --> 00:09:41,760
and they are not prone to
human interpretation or error.

199
00:09:41,760 --> 00:09:44,280
Maybe someone's just distracted or hungry

200
00:09:44,280 --> 00:09:45,880
and they don't notice the issue.

201
00:09:47,310 --> 00:09:50,853
Now, automation can provide
real time monitoring.

202
00:09:52,110 --> 00:09:53,700
And automation is scalable.

203
00:09:53,700 --> 00:09:57,810
So as the credit union grows,
automation can grow with it.

204
00:09:57,810 --> 00:10:00,360
Or maybe the credit union
isn't growing, but the amount

205
00:10:00,360 --> 00:10:03,450
of regulations they have
to comply with grows.

206
00:10:03,450 --> 00:10:06,720
In that case, automation is also scalable.

207
00:10:06,720 --> 00:10:09,240
So having this conversation
and understanding the benefits

208
00:10:09,240 --> 00:10:11,297
of automation to your organization,

209
00:10:11,297 --> 00:10:13,713
absolutely security-in-action.

210
00:10:14,730 --> 00:10:15,750
There's your Word Cloud.

211
00:10:15,750 --> 00:10:17,130
You know what to do.

212
00:10:17,130 --> 00:10:18,580
I'll see you the next lesson.