IT Regulatory Compliance

From an IT perspective, governance and regulatory compliance today is primarily about controls on processing, data protection, information security and the organization's general control environment.

On this page you will find a wide range of information and advice about IT-related regulatory compliance in the US.

On this page:

The Basel Accords
PCI DSS
SOX (Sarbanes–Oxley)
Best-practice Approaches
Compliance Requirements

The Basel Accords

The Basel Accords (Basel I, Basel II, and Basel III) are a series of banking supervision accords agreed by the representatives of the 27 countries that make up the Basel Committee on Banking Supervisions (BCBS).

Developed in response to the global financial crisis of 2008 and its aftermath, they have been adopted by over 100 countries, either directly or through local adaptions, and aim to regulate the levels of capital that financial institutions need to maintain.

For full information, visit our Basel Accords page >>

PCI DSS

The Payment Card Industry Data Security Standard (usually shortened to PCI DSS) is a collection of 12 requirements set out by the PCI Security Standards Council (PCI SSC).

The purpose of this standard is to ensure the security of cardholders’ payment card information and reduce levels of fraud and identity theft.

ALL organizations that store, transmit or process cardholder data must ensure they are complying with PCI DSS in its entirety or face non-compliance fines from their payment brand (e.g. AmEx, Visa, MasterCard, Discover, etc.), or data breach fines.

Merchants are banded into four categories based on the volume of transactions they process each year, with each band being required to meet specific requirements.

Full information, visit our PCI DSS page >>

SOX (Sarbanes–Oxley)

The emergence of the Sarbanes–Oxley Act in 2002 brought statutory pressure to bear on US-listed organizations to demonstrate corporate governance compliance. These requirements have had significant impacts on the internal control and risk management approaches of listed companies.

Under SOX, management is required to register the company’s financial reports and both management and an independent accountant are required to register the organization’s internal controls.

In almost every organization, financial reporting depends on the IT infrastructure, whether it is for the rendering of an invoice, the effective operation of an ERP system, or an integrated, organization-wide management information and control system.

For full information, visit our Sarbanes–Oxley page >>

Best-practice Approaches

ISO27002, ITIL, and COBIT are all potentially part of a best-practice approach to regulatory and corporate governance compliance. The challenge for many organizations is to establish a coordinated, integrated framework that draws on all three of these standards. The solution is to adopt a best-practice approach, such as that set out in the internationally recognized information security standard ISO/IEC 27001:2013.

This standard links to all of the IT-related regulations and provides completely independent, structured guidance for a risk-based approach to securing the confidentiality, availability, and integrity of corporate information. It also provides the general control environment within which the specific controls can most effectively operate.

The ISO27001 Documentation Toolkit provides essential support to organizations implementing the standard.

Compliance Requirements

There are a number of regulations that affect your business. The table below presents a quick reference guide to which ones affect you, what security areas need to be covered and what compliance requirements you need.