Are organizations performing risk/compliance assessments or “gap analysis” prior to inquiring about products?
Typically, without such an assessment, organizations have often had difficulty articulating exactly what problem (or in this case area of compliance) they were trying to address. As a result, it was hard to determine what type of products were needed and what questions to ask. Failure to identify gaps and objectives prior to product evaluation invariably wasted a lot of time and effort. All affected organizations need to use the standards as a benchmark to perform an assessment of their environments prior to exploring product options. Also, I’d add that such an assessment be conducted by, or at least reviewed by, a project group made up of a representative cross-section of the organization, not just IT.
