Category: Compliance

Trust is the bedrock of successful business relationships. It’s an element that must be nurtured well in advance of any customer engagement and remains paramount to enhance an organization’s reputation and market position. Customers are more likely to engage with companies they trust, and this trust is an asset that can take years to build but can be shattered in an instant. That’s why businesses must prioritize compliance and accountability as fundamental building blocks for trust.

Compliance involves adhering to laws and regulations, while accountability demands taking responsibility for actions and decisions. In this post, we will delve into how compliance and accountability contribute to trust-building with customers and offer guidance on achieving these goals effectively.

The Impact of Compliance and Accountability on Trust: 

Maintaining trust with customers is pivotal to long-term success, especially in the digital age where trust is formed and broken without physical interactions. Compliance and accountability are central to fostering a culture of trust within organizations. Examples of Trust Erosion due to Privacy Lapses:

1. A customer receives multiple calls from various financial institutions immediately after approaching their bank. This intrusion into their privacy raises doubts about data security.
2. Customers grow tired of their web activity being tracked and sold for relentless marketing across apps and browsers.

Digital Trust: In the era of digitization, trust has transitioned from face-to-face interactions, handshakes, and physical signatures to the digital realm. A study by ISACA underscores the importance of digital trust, with over 76% of respondents considering it extremely or very important for digital transformation. This highlights the significance of building and maintaining trust in retaining and expanding the customer base.

Compliance and Accountability:  Compliance in a business context encompasses adherence to laws, regulations, and ethical standards specific to the industry and location. It spans various areas, including legal obligations, data privacy, financial reporting, employment practices, and environmental protection. Accountability, on the other hand, signifies taking responsibility for actions and decisions by:

• Acknowledging their impact on the organization, stakeholders, and the community.
• Holding others accountable for their actions.
• Going beyond mere compliance to make ethical decisions and owning their outcomes.
• Creating a culture of transparency, integrity, and trust.

Challenges in Compliance to Digitized Regulations:

1. Exponential Data Growth: Data has grown significantly over the last decade, but poor security practices still expose organizations to data breaches.
2. Cost of Maintaining Data Privacy: Breaches can result in severe regulatory penalties. For example, companies dealing with European customer data can face fines up to 4% of Adjusted Gross Revenue or €20 Million. Similar regulations like GDPR, DPDP, HIPAA, and CCPA emphasize data protection.
3. Increasing Data Breaches and Vulnerabilities: Social engineering attacks, human errors, and external actors contribute to the rise in cyber threats.
4. IoT and Mobile Concerns: Security professionals are increasingly worried about IoT security.
5. Human Error Complexity: Everyday errors can significantly impact data privacy and security.

To enhance Customer Trust through Accountability for Compliance, you need to implement the following within the organization:

• Addressing digitization-related challenges.
• Establishing a robust governance model with well-documented roles and responsibilities.
• Developing and implementing clear policies, processes, and SOPs.
• Cultivating a culture of transparency, integrity, and ethics.
• Conducting regular training and awareness programs.
• Ensuring fairness, growth, and risk management.
• Monitoring and testing the compliance ecosystem.
• Conducting regular audits and reporting findings transparently.

Benefits of Accountability for Compliance:

• Increased Customer Confidence: Demonstrated commitment to ethical operations instils customer confidence.
• Improved Reputation: Accountability maintains a positive reputation, emphasizing transparency and honesty.
• Reduced Legal Risk: Compliance reduces the chances of legal issues and penalties.
• Better Employee Morale: Prioritizing accountability creates a culture of integrity and responsibility, boosting employee morale.

Building trust with all stakeholders, including customers, employees, third-party service providers, and regulators, is essential for an organization’s success. Trust hinges on compliance with rules and regulations, data privacy, accountability, a culture of integrity, and social responsibility. It’s a long-term process that, when approached diligently, paves the way for a thriving organization.

Check how your organization measures Trust building.  Check points with  YES/ NO/ Partially Yes

1. Do you conduct customer/ employee satisfaction surveys?
2. Do you track customer service / employee workplace issues raised ?
3. Do you monitor customer/ employee retention?
4. Do you monitor customer/ employee behaviour?
5. Do you conduct internal review of trust related practices?

In today’s increasingly interconnected and digital world, safeguarding sensitive information is of paramount importance. Whether it’s personal data, intellectual property, or financial records, ensuring information security is crucial for both individuals and organizations. While a voluntary approach to information security might seem appealing, it often falls short of the comprehensive protection required to meet the ever-evolving threats in cyberspace.

Here are some key reasons why relying solely on a voluntary approach is insufficient for information security compliance:

1. Inadequate Incentives:
   A voluntary approach relies on organizations and individuals to take the initiative to implement information security measures. However, without legal requirements or regulations, there may be little incentive to invest in robust security practices. Many organizations prioritize cost savings over security, potentially leaving their data and that of their customers at risk.
2. Varied Levels of Compliance:
   In a voluntary system, adherence to information security best practices can vary widely. While some organizations may take the issue seriously and invest in robust cybersecurity measures, others may cut corners, leading to an inconsistent and fragmented security landscape. This creates an uneven playing field, where the least secure organizations put their customers, partners, and themselves at risk.
3. Lack of Accountability:
   In a voluntary approach, there is no clear mechanism for holding organizations accountable for security breaches or data leaks. This lack of accountability can lead to a culture of negligence when it comes to safeguarding sensitive information. The absence of legal consequences for non-compliance often allows organizations to escape serious repercussions, even when they fail to protect their data adequately.
4. Rapidly Evolving Threat Landscape:
   Cyber threats are constantly evolving and becoming more sophisticated. A voluntary approach may not keep up with these changes effectively. Mandatory information security regulations, on the other hand, can be updated more swiftly to address emerging threats and vulnerabilities.
5. Consumer Trust and Reputation:
   In today’s data-driven economy, consumers are becoming increasingly aware of the importance of data protection. When organizations don’t adhere to robust security standards, it erodes trust and can damage their reputation. Customers are more likely to do business with companies that can demonstrate their commitment to data protection through compliance with recognized standards and regulations.
6. International and Industry Standards:
   Many industries and countries have established information security standards and regulations to protect their citizens and businesses. A voluntary approach may not align with these existing standards, leading to potential conflicts, confusion, and difficulties for organizations that operate internationally or across multiple sectors.

While a voluntary approach to information security compliance may have its merits, it is not a sufficient or reliable strategy to protect sensitive information adequately. To address the evolving challenges and threats in the digital age, a more comprehensive and legally mandated framework is necessary. Strong information security regulations provide a clear roadmap for organizations, ensuring that they meet essential security requirements and are held accountable when they fall short. This not only protects individuals and organizations but also fosters a more secure and trustworthy digital environment for all.

According to recent studies, organizations are shifting their approach to compliance risk management from treating it as a separate vertical to integrating it under operational risk management. This approach allows organizations to assess and measure risk based on residual risk, and focus on the most critical weaknesses. With increasing globalization and complex regulatory compliance requirements, managing compliance risk under the umbrella of operational risk has become essential. This integration also simplifies compliance testing, which can be a challenging task for many organizations.

Digital transformation : Factor-in the current and future trends

All organizations are seeking to get maximum value from their digital transformation. The Covid-19 pandemic has changed the way of business/operations, disrupting and giving opportunity to find new ways to face challenges by adopting to different business models, forcing to move to digitization, which means adoption of digital enablers like Artificial Intelligence (AI)- which includes Machine learning, Big data analytics, Robotic Process Automation (which requires Business Process Mapping to address overlapping process and creating process families), Internet of Things, Cloud/hybrid cloud, operating technology, augmented reality etc.

With a lot more efficiency coming into the system, regulators have also adopted these digital enablers. The above regulatory welcome change makes the corporates to improve and strengthen their compliance function using a more structured approach and digitization to avoid increasing penalties and fines (financial and non-financial) on non-compliance to regulations for their organizations as well as engaged 3rd parties. Although these enablers and technology are used in business growth and compliance, they usher in newer technology related risks, which must be mitigated. For example data/ information security and privacy related risks were not prominent earlier, they have become increasingly prominent in this age of digitization and have necessitated the need for Organizations to change and manage Compliance risk as newer regulations emerge from various regulators.

Data Privacy & security- another factor in the current and future trends

By year-end 2024, Gartner predicts that 75% of the world’s population will have its personal data covered under modern privacy regulations and predicts that large organizations’ average annual budget for privacy will exceed $2.5 million by 2024.

Adopting and implementing some cyber security related audit standards, using standard tools, certifications etc. have become the necessity of the day instead of just adopting these for regulatory purposes.

As an example- let us examine the context of the bank card end-to-end process. The process, if examined in depth, involves not only the Bank, but involves many 3rd party service providers such as card producers, payment gateway facilitators (which may be using cloud), settlement & reconciliation related facilitators etc. As these, 3rd parties may be in one jurisdiction or involve multiple jurisdictions, it becomes necessary to have the regulations driving this universe analyzed, audited under one umbrella- this task is extremely difficult.

Compliance requirements in the current environment moving rapidly to a digitized business environment

The technology operations (involving compliance to many regulations) require tools and audit to mitigate the risks. Organizations  use Security Operations Centre (SOC), Privilege Access Management (PAM), Network Access Management (NAM), Firewalls etc. for their IT infra and warrant the engaged technology 3rd parties to have these in place to mitigate risk and regulatory compliance. Further, using ISO framework/ NIST framework etc. strengthen the organizations to strengthen their IT infra with detailed audits for gaps and controls. Certifications of these agencies help the Organization to satisfy the regulator as well as retain their existing customer base. Additionally using tools like VAPT help organizations to assess the vulnerability and penetrations by rogue players against their IT infra defences  systems.

Data aggregation, data management, data analytics, data security etc. have assumed significant levels – although primarily one looks at these from an Operational risk perspective (which includes compliance risk), one requires to understand that above mentioned data related aspects accompany a lot of regulatory/global standards compliance requirements.

Some examples to address the above concerns on data/ information are say PCIDSS (on card data) HIPPA (for health records/ data of patients), GDPR (for personal data protections) etc. which are standards used globally.

QRC Services:

QRC Assurance and Solutions as an organization has worked extensively on addressing issues emerging from the current and future compliance requirements. Some of the audits/ tools provided by QRC Assurance and Solutions include:

– PCIDSS (Card Holder Data), HIPPA (ePHI), GDPR (PII) appropriately for Organizations to assess and address the gaps resulting from data security and privacy related at the People, Process and Technology of the organization as well as any engaged 3rd party providers.

– Conduct Audits on prescribed data security/ privacy standards by various regulators such as RBI, NABARD, IRDA, UIDAI, SEBI, SWIFT etc.

– Perform Vulnerability and Penetration Testing Scans using various techniques including Black box, Grey Box, White Box Testing.

– Perform configurations audits to assess the technology and systems related gaps.

QRC Assurance and Solutions offers QRCAssist, a centralized platform that provides effective compliance management System and Self-Assessment tool (SAT) to organizations to help them evaluate/ assess their status of Compliance vis-à-vis various standards/ regulations.

Creating a secure organization is a complex and vital aspect for any business or organization, that requires a systematic approach. Organizations must take a step-by-step approach to build secure processes and systems with the help of appropriate people, process, and technological controls. Building a secure environment is not a one-time event but a continuous process that requires a systematic approach.

Step 1: Assess the Current Organization Risks

The first step in creating a secure organization is to assess the current state of security within the organization. Main part is to identify and assess the risks that the organization faces. As a starting point, this assessment should consider all business functions of the organizations and their corresponding dependent outsourced functions if any.

Identify the assets that need to be protected, the potential threats that could compromise those assets, and the likelihood of those threats occurring. Once the risks have been identified, organizations can then take appropriate measures to mitigate them. Once the current state of security has been identified, the organization can then develop a plan to address any identified vulnerabilities and risks.

Step 2: Implement Appropriate Controls to Mitigate the Risks

The second step is to implement controls to protect assets. These controls can be grouped into three categories: people, process, and technology.  These controls should be designed to mitigate the organization’s risks, while also considering the organization’s unique needs and requirements.

• People controls include policies and procedures that ensure that employees are aware of their role in maintaining security and that they understand their responsibilities. Example of People Controls such as employee training and awareness programs, as well as background checks and security clearances for employees etc.,
• Process controls include procedures and guidelines for how the organization handles sensitive information and how it responds to security incidents. Process controls include things such as security policies and procedures, incident response plans, and business continuity plans.
• Technology controls include physical and digital security measures such as firewalls, intrusion detection systems, and encryption.

Step 3: Monitoring and Review

The third step is to monitor and review the organization’s security posture. This includes regularly review, Test and update the controls to ensure they are still effective in protecting the organization and they are functioning as intended and that they are keeping the organization protected. This includes reviewing policies and procedures to ensure that they are up-to-date and effective, regular security assessments, penetration testing, and vulnerability assessments to identify any new vulnerabilities etc.,

In addition, organizations should also establish a culture of security within the organization. This includes educating employees about the importance of security and the role they play in maintaining it. It also includes holding employees accountable for adhering to security policies and procedures.

Step 4: Continual Improvement.

The final step is to continuously improve the organization’s security posture. This includes staying informed about new threats and vulnerabilities, identifying new risks, and implementing new controls as needed.

Conclusion:

In conclusion, creating a secure organization requires a systematic approach that involves identifying risks, implementing controls, monitoring, and continuously improving the security posture. Organizations should take a step-by-step approach and should not hesitate to seek the help of experts in the field if needed. Remember that security is an ongoing process, and it’s important to be proactive and keep your organization’s security posture current.

We at QRC, are pioneers in Cyber risk and cyber security governance  vary from industry to industry. It is unique in its way and so is how each organization handles the risks they are exposed to. This is one of the main reasons why there is a need to execute cyber security with deep analysis. The nature of cyber security in the Petrochemical industry is extensive in nature, starting from the core source of supply from the oil pipelines through the refineries to the point of sales at gas stations. The kind of risks faced throughout this process are high-level risks that can cause the functioning of the company to collapse completely. It is also referred to as “Enterprise risk”. So how to achieve the objective of cyber resilience in such a situation…?

Read through to gain a comprehensive insight into the risks faced by the Petrochemical industry, sources of cyber threats, current industry-specific guidelines prescribed for cyber security, and best practices to achieve better cyber resilience.

Current challenges faced by the industry

A quick look into previous incidents of the data breach: a few events reported in the past:

• 1.  May 2021, USA: It is known as the hack that took down Colonial pipeline company, the largest fuel pipeline of the US, leading to a shortage across the East coast due to a single compromised password. A ransom note demanding cryptocurrency appeared on computer screens and was spotted by employees.
• 2.  July 2020, USA: The National security agency and the Cybersecurity and infrastructure security agency of the US alerted the world about cybercriminals hacking into critical infrastructure across the country.
• 3.  Feb 2020, USA: A pipeline company was attacked. HMI was affected resulting in the forced shutdown of a gas-compression facility station and other upstream-downstream facilities, for two full days.
• 4.  2017, the Middle East: The notorious Triton virus attacked the controls and security of a petrochemical company resulting in multiple shutdowns and halted operations over several months. The Triton still affects a lot of systems.
• 5.  2019, Mexico: Pemix, Mexico’s state-owned oil company was attacked by ransomware resulting in the forced shutdown of systems across the country. The perpetrators demanded a ransom of a Bitcoin worth five million to unencrypt the systems.
• 6.  2017, Ukraine: The Not Petya attack on a Ukrainian facility resulted in the shutdown of the country’s power grid.
• 7.  201
• 0, Iran: Stuxnet is used in damaging an Iranian nuclear facility. Responsibilities have risen for the energy sector’s top executives and Board members to navigate the big challenge of cyber security.

Analysis of various factors creating vulnerabilities:

Surface attacks due to the nature of systems:  Attackers take advantage of any openings that are available to them. The systems in the Petrochemical industry are such that it requires increased availability of data for better efficiency of operations and for gaining from situational awareness. This, in turn, increases the surface area of attacks and potential exposure to vulnerabilities. So, systems are available to them and attackers are opportunistic.

Attacks due to technological advancements:  The large and ever-increasing numbers of mobile phones, tablets, and all the other devices with access to operational systems for input, payments in the gas stations, and other ease of operations at various stages of production. These are all possible entry points for attackers. Other technological advancements like the Internet-of-things, metering infrastructure will keep on arriving on the scene and creating vulnerabilities for newer cybercrime. Technological advancements also mean cybercrime advancements.

Attacks due to human error in operations:  IBM research suggests that 27% of cyber-attacks in the industry are a result of human error. Thus, when it comes to tactics against data and privacy breaches, it must include employee and staff training, clear well-established practices and policies, and fixing employee roles & responsibilities. Owners should establish cyber-security roles and these employees/individuals must develop and educate other employees on policies and procedures.

Cyber-security and safety policies must integrate human elements with the control system especially in system usage, maintenance, updates, etc. The policies must also address personal devices since misconfigured devices are vulnerabilities and easy targets.

Attacks due to ease of access:  When it comes to the Oil and Natural gas industry, the physical aspect plays a major role. Networks must be segregated from the area of active operations and access has to be separate. For example, it is best practice to keep IT, operations, and security separate from the rest of the production unit. Access to the whole system should not be made available to all and sundry at a time. Even if the area of production is infiltrated or compromised, the whole system should not be exposed. Another common trap for operators is that of forgotten control systems which are at risk of attacks.

Attacks due to the nature of authority in the industry:  Despite increasing and diverse risks in the Petrochemical industry, awareness, and stakes, the majority of the management and executives still believe that they are not directly responsible for security. It is mistakenly believed that cyber safety is the responsibility of a separate department, they see it as an aspect that is separate from the main functions. Or that the threats are unavoidable due to the nature of the industry. There can also be a belief that it is not possible to counter the diverse threats, that there is not enough expertise, tools, or charters to counteract the attacks. This can lead to complacency among non-IT stakeholders, making the job of the IT team more difficult and also creating blind spots which can be exploited. Cyber-security must be regarded as a shared responsibility of all stakeholders, especially all employees in a company, from top-level executives to front-desks.

Existing guidelines and standards for cyber security:

The industry’s standard-setting bodies are- Department of Commerce’s National institute of standards and technology (NIST), the Department of Energy (DOE), and other U.S. and international standards-setting bodies. Programs such as the ISA/IEC 62443 Series of Standards on IACS Security and the DOE Cybersecurity Capability Maturity Model (C2M2) in association with the above-mentioned bodies help organizations in implementing the standards. Some of the standards are –

• 1. ISO 270001
• 2. API 1164
• 3. API Standard 1164
• 4. Department Of Energy Cybersecurity Capability Maturity Model
• 5. International Electrotechnical Commission’s IEC 62443
• 6. International Organization For Standardization ISO 27000
• 7. Content unique to pipelines not covered by NIST CSF and IEC 62443 is being currently updated.

Strengthening cyber security:

1. Segmentation of control systems architecture:  Compartmentalizing lessens the access and prevents baring the whole system to attackers. Keeping critical infrastructure and business systems on different networks is essential for minimizing risk. Additional segmentation can also be considered to protect critical assets. The key concern here is not allowing access to the whole system when one area is attacked or compromised.
2. Continuous evaluation and enhancement:  Policies, procedures, and control systems have to be consistently and continuously evaluated and improved. Training must also be evaluated and enhanced regularly. Constant vigilance is a key to protecting against internal and employee errors. It is easier for timely detection and correction.
3. Professional analysis of systems and their impacts:    The following factors have to be considered, namely
   1. Cost,
   2. Value,
   3. The company’s policy framework towards cyber-threat i.e is it a policy of transfer of risks or a policy of mitigation or a policy of acceptance,
   4. Investment areas,
   5. Funds allocation,
   6. Technological infrastructure and
   7. Expertise is available.

Read more about this: Cybersecurity Compliance and e-Rupee: Need for Strong Measures

The analysis must be made not only in the initial stage but companies must keep routinely analyzing, keep adapting, and building on technological advancement and complexity.

1. Computer control systems and computer security are not tangential:  Control systems and security systems must always be considered in tandem. Consider cyber-system controls and cybersecurity in tandem. Cyber-security and cyber-resilience are best achieved when implemented across the entire system design and planning process.
2. Control systems are considered as assets:  Systems are just as important as other tangible or intangible assets like pumps, pipelines, equipment, brand, etc. that require routine maintenance, replacement, improvements, and audit/evaluation.
3. Being part of guilds/groups:  As of now, there is the Oil and Natural gas Information Sharing and Analysis Centre. It is an industry group of private intelligence sharing regarding cyber-threats.

1. Awareness:  Staying alert and aware cannot be emphasized enough. There are many resources available like the website of the US Department of homeland security which actively publishes about various vulnerabilities. Owners must stay ahead and address the emerging and diverse concerns before cyber-criminals take advantage of them.
2. Following standards:  The generally accepted practices and frameworks have to be implemented and followed meticulously. Some of them are ISA 62443, NIST 800-82, and the cyber security framework of the American Petroleum Institute.

1. Compartmentalize and segment control system network architecture:  This lessens access and keeps business systems on a different network than critical infrastructure. Consider additional segmentation to protect critical assets and prevent hackers from accessing the whole system if they find a way into one area.

Overview of the cyber resilience principles by WEF :

Cyber resilience principles for the oil and gas infrastructure companies, as outlined by The World economic forum are as follows:

1. Cyber resilience governance –  policies and systems must be planned and implemented beginning at the governance level, since security counts on organization-wide participation from the management to the grassroots level. Aligning all the efforts and fixing accountability is fundamental to the success of the system.
2. Resilience by design –  Cyber-security need not be a separate department to be individually planned and implemented. It can be included as a design parameter and as part of the corporate culture. It will significantly improve the outcomes and effectiveness of the security system.
3. Corporate responsibility for resilience –  Recognizing and accepting that diverse, frequent, and ever-advancing threats cannot be prevented and that they will continue to occur or at times escalate to a huge threat is helpful, since it enables companies to be proactive and take responsibility and initiative. It is the first step in managing risks.
4. Holistic risk management approach –  as is the case of any risk management, cyber resilience and management require a mandate, funds, resources, and accountability. In this sector, it is important to mitigate risks to all parts of the value chain so that one weak link doesn’t bring production to a halt.
5. Ecosystem-wide collaboration –  Weak points in defense security may lie outside an organization too. Efforts to share cyber threat information, use of best practices, and improve cybersecurity maturity across the whole sector help industry-wide stability.

Ecosystem-wide cyber resilience plans –  As mentioned earlier, recognizing that cyber-attacks will continue to occur, organizations should build resilience plans to help mitigate damage from those organizations that have succeeded. Regular cybersecurity exercises enable them to test and improve defenses – including how they will cooperate with other industry partners.