Risk Grustlers Ep 11 | The upshot of (un)continuous compliance

Welcome back to Risk Grustlers, Season Two! In this podcast series, we delve deep into the journeys of risk leaders, exploring how they navigate the ever-evolving terrain of cybersecurity. After a successful first season featuring insightful interviews with ten industry experts, we're thrilled to kick off Season Two with even more compelling content.

https://www.youtube.com/watch?v=v4fvywG2QxI

In today's episode, we're marking a significant transition. Our host for season 1, Aayush, is passing the baton to Todd, who will now take the lead as our new host.

Todd, CISO at Scrut Automation and Zluri, and an esteemed advisor to startups like Box and Zoom, brings a wealth of experience to the table. Join us as we welcome Todd to the spotlight and embark on this new chapter together.

So, without further ado, let's dive into Todd's fascinating journey through compliance, GRC, and risk management.

Aayush: Todd, can you share how you initially found your path into compliance, GRC, and risk management?

Todd: My journey into compliance and risk management began unexpectedly during my college days when I stumbled into a job at the computer lab. Despite being a business major, the opportunity to work in IT sparked my interest. As I progressed through various roles, including serving as a VACC administrator and leading IT efforts in commercial real estate, I developed a keen understanding of cybersecurity controls and risk management. The pivotal moment came during the dot-com crash of 2001, which led me to focus on regulated industries like biotech. Working in highly controlled environments exposed me to the intricacies of compliance and laid the foundation for my expertise in the field.

Aayush: What were some pivotal moments in your career that shaped your expertise in compliance and risk management?

Todd: The dot-com crash of 2001 was a turning point for me, leading me to focus on IT efforts in regulated industries like biotech. Working in highly controlled environments laid the foundation for my understanding of compliance and risk. Additionally, my involvement with early-stage startups and advisory roles with companies like Box and Zoom provided invaluable insights into the challenges and opportunities in compliance across different sectors. These experiences shaped my approach to navigating the evolving terrain of cybersecurity and risk management.

Aayush: You've worked extensively with startups on achieving SOC 2 compliance. What are some common mistakes you've observed during this process?

Todd: One common mistake among startups is neglecting to maintain compliance post-certification. Many overlook the continuous monitoring required, leading to frantic efforts to catch up during surveillance audits. I've seen instances where startups celebrate obtaining their SOC 2 certification but fail to implement ongoing compliance practices. This oversight can jeopardize their reputation and hinder future business opportunities. Additionally, startups sometimes underestimate the manual effort required, especially when it comes to implementing basic security controls and training for employees.

Aayush: How can small companies effectively manage continuous compliance, especially amidst rapid growth and other business priorities?

Todd: Small companies can benefit from leveraging GRC automation tools to streamline compliance efforts. By adopting automated solutions like Scrut, they can automate routine tasks, monitor compliance in real time, and streamline the audit process. This allows small companies to allocate resources more efficiently and focus on strategic growth initiatives. Additionally, integrating compliance into the company culture and regularly assessing and updating compliance policies can help ensure ongoing compliance amidst rapid growth and evolving regulatory landscapes.

Aayush: Todd, you've navigated compliance in both large pharma companies and small startups. What are the key differences you've observed in managing compliance between these environments?

Todd: In larger companies, compliance efforts are more complex and require unified control frameworks to manage multiple frameworks efficiently. Compliance audits in the healthcare industry, for example, are extensive and involve various teams beyond IT. In contrast, startups have the advantage of agility but may lack dedicated resources, requiring external guidance. The key is to strike a balance between comprehensive compliance efforts and resource constraints, adapting strategies based on the organization's size, industry, and regulatory requirements.

Aayush: Can you elaborate on the role of automation in GRC, particularly in optimizing compliance efforts for companies of different sizes?

Todd: Automation plays a crucial role in simplifying compliance tasks, particularly for smaller companies with limited resources. Automated tools like Scrut streamline processes, reduce manual effort, and ensure consistency in meeting regulatory requirements. For startups and small businesses, automation is especially beneficial as it allows them to scale compliance efforts without significantly increasing overhead costs. By leveraging automation, companies can achieve greater efficiency, accuracy, and agility in managing compliance across various regulatory frameworks.

Aayush: Todd, you've experienced audits in both healthcare and tech industries. How do these audits differ, and what challenges do they present?

Todd: Audits in healthcare are more extensive and involve various teams beyond IT. Compliance audits in the healthcare industry, for example, are extensive and involve various teams beyond IT. In contrast, tech industry audits focus primarily on security controls and are simplified with the help of automated tools. Additionally, audits in regulated industries like healthcare often require adherence to specific industry standards and certifications, adding complexity to the audit process.

Aayush: As we conclude, what advice would you offer to companies striving to maintain compliance amidst evolving regulatory landscapes?

Todd: Stay proactive and prioritize compliance as an integral part of your business strategy. Leverage automation tools, seek expert guidance when needed, and remain vigilant in monitoring and adapting to regulatory changes. Compliance is not a one-time effort but an ongoing commitment that requires continuous evaluation and improvement. By staying informed, implementing best practices, and embracing technology, companies can navigate the complexities of regulatory landscapes and ensure long-term compliance and success