When corporate governance in itself is a risk

Information security is no longer just good business practice. It is becoming a legal obligation.

This is according to Michael Silber, consultant at law firm Michalsons Attorneys, which was involved in drafting an Institute of Directors best practice guide for information security that outlines the implications of the King II report.

Compliance is also a very complex issue business is grappling with, especially in SA with the promulgation of laws such as the Electronic Communications and Transactions Act, the Interception Act and the Promotion of Access to Information Act.

Research shows that regulatory compliance is at the peak of the "hype cycle", which Gartner uses to measure the popularity and maturity of various issues and technology.

"While compliance is good, some organisations are getting so caught up in endless documentation and reporting, that Gartner warns one of the biggest security risks today is distraction by the details of the issues and the paperwork that is involved," says Silber.

A significant development, according to him, has been the discussion paper on privacy and data protection by the SA Law Commission. A principle proposed by this paper specifically requires holders of personal information to implement security measures to ensure the integrity of personal information.

Apart from protecting individual privacy, other concerns include ensuring the viability of business operations and avoiding identity theft, safeguarding sensitive business data, ensuring accountability for corporate financial information, and preserving the authenticity and integrity of transaction data. Companies also obliged to report - both to affected parties and to a privacy commissioner - any security breaches discovered.

"This is the first time issues like these are to be codified in law, and specific new obligations on businesses to implement information security measures are imposed," says Silber.

The legal trend is to define security as a process, elements of which are that the company must, as Silber puts it, "engage in an ongoing and repetitive process to assess risks, identify and implement appropriate security measures, verify that these are effectively implemented, and ensure that these are continually updated in response to new developments.

"A key aspect of this process is recognition that it is never complete. It is ongoing, and is continually reviewed, revised, and updated," says Silber.

He warns that in the South African context, compliance is often driven by US compliance requirements, so a lot of companies are often wasting time complying with unnecessary things, and letting risks slip through the cracks.

"In the area of security products, for example, business complies with US laws on functional requirements, but those laws don`t apply here. That`s what is distracting a lot of people: not working out the proper local compliance criteria."

The Institute of Directors recommends that companies identify the key information security compliance requirements in terms of applicable law, contractual obligations, industry regulations and information security baseline standards, together with target compliance levels.

Then, they should develop and implement processes in order to sustain compliance levels and desired target levels. As compliance becomes more process-driven, notes Gartner, the threat of distraction will fade.