The ROI of Noncompliance in the Mid-Market

Sox and HIPAA continue to be a mountain too high to climb.

The bigger the company, the larger (one would assume) its security budget, the more staff it can dedicate to security, the likelier it is to have a CSO or chief compliance officer and the greater its ability to afford more technology and implement better compliance processes and governance. So bigger companies should be more compliant than smaller ones, right?

Sometimes yes, sometimes no. For example, 13 percent of large companies admitted to not being compliant with the Gramm-Leach-Bliley Act (GLBA) compared with only 11 percent of midsize companies (those with revenue between $100 million and $1 billion), according to the “The Global State of Information Security 2006” survey conducted by CIO and PricewaterhouseCoopers (see the article here). However the compliance rates flipped when it comes to Sarbanes-Oxley. A little more than one-third of large U.S. companies say they are not compliant with Sox; 43 percent of mid-market companies are not compliant.

The same swing can be seen with other laws. Twenty-five percent of large companies are not compliant with California’s security breach notification law but only 14 percent of midsize companies are not compliant. Midsize companies are less compliant when it comes to the Health Insurance Portability and Accountability Act, or HIPAA (27 percent of midsize companies are noncompliant versus 21 percent of large companies).

The reason, as usual, is money. Sarbanes-Oxley and HIPAA compliance is more complicated and expensive than, for example, GLBA compliance. But the mid-market’s excuse that it doesn’t have the money to comply may be becoming obsolete. According to Mark Lobel, a PricewaterhouseCoopers advisory partner specializing in security, the price is dropping for technologies that help companies comply with security and privacy laws. With affordable tools coming onto the market that can sniff out the data you need to protect, excuses from mid-market CIOs that it’s too expensive to comply with Sox and other laws will no longer work, Lobel asserts.

“You can get 80 to 90 percent of what you need to find,” says Lobel. “And that does a lot to comply.”