The Legal Environment

An organization's legal environment is influenced by local legislation and regulation in every location the organization operates in, as well as local standards and contractual requirements. The responsibility to uphold organizational compliance is usually that of the legal team; however, as security professionals, it is our responsibility to uphold said legal requirements from a technical and methodological point of view. Being responsible for upholding compliance does not mean that the legal team is accountable. Accountability for compliance falls into the lap of company C-level executives; the legal and security teams map the requirements, create the work plan, present it to the executives, and are responsible for implementing it. In many cases, upholding legal requirements requires the organization to implement technical mechanisms and perform compliance audit reviews. One of the most important relationships a security manager should have in the organization is with the compliance officer.

Understanding the legal requirements imposed on the organization helps the security manager identify where to invest based on external mandates, reduce the noncompliance risks, and gain management's support.

External Requirements Every organization operates under external mandates. These mandates can come in the form of simple contracts, as part of the organization's interactions with suppliers and customers. Mandates can also come in the form of governmental imposition. Governments create regulations, either through legislative or administrative means, and organizations must adhere to those that are relevant to the industry and the organization. Traditional and cultural mandates also arise. Some of these take the form of standards, which each organization is held to by custom and, in some jurisdictions, by legal precedent and liability.

Compliance is adherence to a mandate, regardless of its source. Almost every organization is required to demonstrate compliance with mandates.

Compliance means both the action on the part of the organization to fulfill the mandate and the tools, processes, and documentation that demonstrate adherence.

Organizations are often reviewed to determine compliance with applicable mandates. Often, the tools, processes and activities used to perform compliance reviews are referred to as audits or auditing.