Network compliance is about more than enforcing internal requirements for change controls and configuration standards. Those internal controls and standards must often align with government regulatory requirements and external cybersecurity standards.
Network engineering teams know how to set design and configuration standards, and they have plenty of experience with imposing change controls. However, they are rarely experts on integrating these technical practices with external regulations like GDPR and PCI-DSS or external security frameworks like the NIST Cybersecurity Framework or ISO-27001.
In fact, only 45% of IT professionals believe that the network-related requirements of regulations and external security frameworks are clear and specific. Most see instances where they must translate those requirements into their internal technical network compliance practices, according to new research from Enterprise Management Associates (EMA). This gap in specificity presents significant risks to enterprises.
Network Compliance Success is Elusive
EMA’s research report “Network Compliance Strategies: How Enterprises Align their Networks with Regulations and Security Requirements,” based on a survey of 251 enterprise IT professionals, found that only 38% of enterprises have completely successful network compliance practices. When the network engineering team has primary ownership of these practices, they tend to be less successful.
Instead, our research found that the IT architecture group was most likely to lead a successful network compliance strategy. IT architecture teams are typically multidisciplinary, with network, security, cloud, and application experts. This mix of expertise helps with translating external requirements into internal compliance controls.
In fact, EMA found that IT architecture groups often partner with network engineering teams on compliance. The architecture group sets requirements, and the network engineering team implements.
Over the years, EMA has spoken to many network architects and engineers who have made themselves experts on specific compliance requirements, especially if they have worked within a single regulated industry for a many years. However, regulatory requirements are secondary areas of expertise for most network engineers, who tend to be more focused on developing general network security know-how.
Network Engineers Need Help, But Other Groups Have Their Own Weaknesses
EMA recommends that network engineering teams partner with other groups on compliance. But engineering teams must also be aware that other groups have their own weaknesses. For example, 55% of network teams consult with their company’s governance, risk, and compliance (GRC) team when they need guidance on how to translate regulatory requirements into network policy. And 33% of companies give GRC teams at least partial ownership of network compliance. When that happens, GRC tends to rely more on manual processes rather than automation.
GRC teams may bring knowledge of regulatory requirements to the table, but they clearly have a knowledge gap around the importance of automating network controls. Our research finds that mature network automation is essential to an effective compliance practice. Network engineers who collaborate with GRC groups will have to evangelize automation, especially if a portion of the compliance budget is controlled by GRC groups.
EMA’s research found that 49% of network compliance practices are driven at least in part by cybersecurity insurance requirements. Moreover, cybersecurity teams have partial ownership of network compliance in 50% of companies. When cybersecurity leads, network compliance practices tend to have a broader scope. Cybersecurity teams attempt to align it with a larger number of standards and regulatory regimes. This can invite too much complexity. EMA suspects that cybersecurity teams are being overly aggressive, especially with the number of security standards they are applying. Network engineers will have to argue for reduced complexity and push cybersecurity teams to consolidate compliance requirements to drive simpler architecture.
As network engineering teams partner with these groups on compliance, they should advocate for collaboration, automation, and simplicity. Network engineers know the dangers of manual operations, and they know the pain of complexity. They should push hard against any partners who fail to see the importance of automation and who reject efforts to simplify compliance practices. While IT architecture, GRC, and cybersecurity offer essential expertise, network engineers know networking better than any other group.
