Something that has irritated me for a very long time are vendors who see a chance to make a quick buck off of worried organizations, afraid they are not going to be in compliance with new laws, and create junk products to sell to them using fear, uncertainty and doubt (FUD). FUD products.
I saw a lot of HIPAA FUD back when that regulation went into effect, and saw way too many people spending way too much money for so-called HIPAA security and privacy certifications offered by vendors who did not even have anyone on staff with any type of healthcare provider, payer or clearinghouse practitioner experience. Not to mention HIPAA compliance solutions.
On April 16, 2007, the Financial Accounting Standards Board (FASB) warned its constituents to on the alert for people and organizations falsely claiming to be members of the Financial Accounting Board staff and promoting the sale of Sarbanes-Oxley Act compliance materials.
“The Financial Accounting Foundation (FAF) has been informed that some of its constituents have been contacted by parties falsely claiming to be members of the Financial Accounting Standards Board staff and promoting the sale of certain Sarbanes Oxley compliance materials. The FAF has brought the matter to the attention of the U.S. Securities Exchange Commission and law enforcement and strongly urges constituents who are subjected to this scheme to contact their local authorities.”
FASB operates under the oversight of the Financial Accounting Foundation (FAF), which is responsible for funding the activities of both FASB and its counterpart for state and local government, the Governmental Accounting Standards Board.
Folks, please beware of slick talking sales folks who promise you quick and easy, complete compliance, with their new and dandy automated technology solution. I’ve seen way too many products promise to make organizations 100% compliant with various, and sometimes all, laws and regulations just by installing it on a network and then sitting back and doing nothing else.
Legal and regulatory compliance generally requires a great amount human work…training, ongoing awareness, creating policies and procedures that are tailored for *YOUR* organization and not just cookie cutter statements that any organization can use, assessing risk within your organization, and so on. Yes, much compliance activity can be automated, but a significant amount must be done through thoughtful planning, analysis, and human interaction.
Don’t let any vendor convince you that his or her product will make your organization 100% compliant with SOX, HIPAA, GLBA, or any other regulation; you would just be buying magic beans and snake oil if you believed the sales pitch.
Tags: awareness and training, corporate governance, FAF, FASB, Information Security, IT compliance, privacy, Sarbanes Oxley, Section 404, SOX