Why do Enterprises Struggle with Technology Compliance?
In the last year, I have talked to leaders such as CXOs, VPs, Technology Heads and CISOs in medium and large organizations to understand how they track and establish if they are doing all they should be doing to secure their Technology assets.
The topic of discussion was Technology Compliance. Broadly speaking, Technology Compliance refers to the process of ensuring that an organization’s technology systems, practices, and operations adhere to relevant laws, regulations, industry standards, and internal policies.
After talking to them, I got a ‘mixed bag’ of responses. No one said that they had it all under control. Most of them said that they knew the importance of Technology Compliance. Some even had it in place in some size or shape. However, there was no sense of urgency until a mandate or deadline was issued by the RBI, SEBI, or another regulatory authority.
In the last 4 to 5 years, there have been several cases of Data Breaches. The famous cases include an online learning platform exposing 11 million User Accounts, a health insurance organization losing its sensitive personal and medical data, and an online stock trading platform suffering a cyber breach that exposed the KYC data of 2.5 million customers.
According to a report, the global average cost of a data breach reached $4.88 million in 2024, a 10% increase from the previous year.^1
If risk and threat is known, why are companies not ready? Here is what I found.
With a focus on going ‘digital’ that produces a lot of data and needs a large IT infrastructure, brings the issue of its protection and security, adherence to data protection laws, cybersecurity frameworks, and overall standards that have become mandatory part of doing business. However, many organizations continue to struggle with Technology Compliance — particularly in the areas of data security and IT infrastructure.
I also read a survey report from KPMG that says, A vast majority of CCOs (84 percent) say their companies will likely face increasing regulatory expectations and scrutiny in the next two years, with the greatest pressure coming from customers, regulators and social policy/public perception.^2
Let us look at some of the reasons.
1. Fast change threat landscape
The rapid pace of digitization offers less time to put the data security measures in place, and ensure that they are working. It may give rise to potential cybersecurity attacks; data privacy concerns; inequality where IT infrastructure may not be completely available and accessible; vulnerability to disruptions and outages; and complexity of data management.
Also, hackers often seem to stay a step ahead of security measures due to a combination of technical skill, creativity, and agility.
2. Lack of Clear Regulatory Awareness
Organizations across sectors—IT services, banking, finance, healthcare, manufacturing, telecom, etc.—commonly adopt ISO/IEC 27001. It is not mandatory but is beneficial to demonstrate their commitment to information security and build trust with clients and partners. However, many others are mandatory.
In US HIPAA (Health Insurance Portability and Accountability Act), PIPEDA (Personal Information Protection and Electronic Documents Act), CCPA (California Consumer Privacy Act) are mandatory.
In Europe GDPR (The General Data Protection Regulation) is commonly used.
In India there are several Acts including Information Technology Act, 2000 (IT Act), Digital Personal Data Protection Act, 2023 (DPDP Act), Telemedicine Practice Guidelines & Health Data Regulations for Healthcare companies, RBI Cybersecurity Framework for Banks and NBFCs, CERT-In Directions (April 2022 onwards), E-commerce and IT Rules (2021), Telecom Regulatory Authority of India (TRAI) Guidelines for ISPs and Telecom sector.
With frequent regulatory updates and inconsistent enforcement across sectors, compliance often becomes reactive, fragmented, or ad hoc.
A VP – Information Technology said to me that they have an in-house team to take care of internal data security but what they are looking for is an assurance that they are doing what they ought to be doing.
3. Underinvestment in Cybersecurity Infrastructure
Data security is the cornerstone of technology compliance, yet many enterprises still operate with legacy IT systems that are vulnerable to modern threats; lack adequate firewalls, encryption, access controls, or monitoring; fail to conduct regular vulnerability assessments or penetration testing.
Adequate budget is not allocated to this area; it is relatively lower priority item and gets pushed to the ‘next quarter’ for ‘next year’ due to budget constraints and a belief that ‘it will not happen to me’. It is especially true to small and medium enterprises (SMEs).
4. Skill Shortage and Talent Gaps
Qualified Cybersecurity and Technology Compliance professionals are in high demand and in short supply. Enterprises face difficulty in recruiting and retaining talent with certifications such as CISSP, CISA and CISM. There is a lack of in-house knowledge to interpret and implement technical controls aligned with regulations. Often there is over-reliance on external consultants. The consultants can only guide on ‘what to do’ but the actual ‘doing’ has to be done in-house.
Especially a panic button is struck when a suspected email is received or an attempt to impersonate someone at the organization occurs.
5. Lack of a Solid Framework
Many organizations are aware that they have to be compliant, and they do things ad-hoc. They do not follow a particular framework. Because of this there is no continuity, no consistency in control implementations. There is high dependence on people. You are lucky if you get a person who is diligent or else there is always a risk of things falling through the cracks.
I remember someone saying to me that a GRC framework is good if you are aiming for a certification. That is so not true. Even for your internal governance, you need to follow a framework.
One classic example is you may have a policy in place when you are starting a new project or getting new infrastructure. But at the end of the project what is your data retention policy, how are you getting rid of old assets are often neglected creating huge security risks.
6. Cloud and Third-Party Risks
As businesses move to the cloud and outsource IT services they inherit third-party risks related to data handling, storage, and protection. Contracts often lack robust data protection clauses, SLAs, or audit rights. There is poor visibility into where and how sensitive data is stored, processed, or transferred — creating compliance blind spots.
Acts like DPDP place a lot of focus on Vendor Risk Management.
7. Low Priority Given to Compliance by Leadership
Many business leaders still regard Technology Compliance as a mere “checkbox exercise” — a mandatory obligation rather than a strategic enabler. As a result, compliance initiatives often lack strong executive sponsorship, receive minimal budget support, and remain poorly integrated into IT planning and product development.
Without active leadership engagement, compliance remains reactive and tactical, rather than becoming an embedded, proactive part of the organization’s culture — something that is naturally woven into day-to-day operations and decision-making.
For example, is security vulnerability testing part of your testing and release process in the Change Management domain?
8. Challenges with Audit and Documentation
Documentation is a critical part of compliance — from onboarding to providing access to logging incidents to maintaining audit trails. It is not only important to ‘comply’ but to prove that you are compliant. However, in many cases, the audit processes are manual, inconsistent, and incomplete. During regulatory inspections, the absence of documentation leads to a lot of rework just to create that evidence or the worst case, compliance failures.
How the Enterprises Can Improve
These findings are in no way meant to be critical. Instead, I want to focus attention on some of the improvement measures.
To address these challenges, organizations need a more structured and proactive approach to technology compliance:
Conclusion
Compliance technology is already helping companies move faster, navigate complexity, and avoid hazards. For compliance, this includes better visibility of risks and risk management activities (64%), faster identification and proactive response to compliance issues (53%), higher quality/more insightful reporting (48%), and increased productivity and cost savings (43%). ^3
Technology compliance is not just about avoiding penalties — it’s about building trust, resilience, and long-term business value. As the enterprises navigate a digital-first future, they must take a hard look at their data security practices and IT infrastructure readiness. Those who invest early and build compliance into their core strategy will not only avoid regulatory pitfalls — they’ll lead the way in digital transformation.
References:
1 https://www.ibm.com/reports/data-breach
2 https://kpmg.com/dp/en/home/insights/2024/02/kpmg-global-cco-survey.html
3 https://www.pwc.com/gx/en/issues/risk-regulation/global-compliance-survey.html
