Last month, I spoke during the Innovation Showcase at the Financial Services Information Sharing and Analysis Center (FS-ISAC) Fall Summit. The goal was to update this group of high-level security professionals on a continuous compliance managed services solution that helps solve the cloud compliance dilemma — and on the solution’s first successful implementation. In a consortium of more than 30 financial services firms building an industry-standard cloud control framework, almost all reported regulatory compliance as a major hurdle to cloud adoption.

Overcome the Challenges of Cloud Compliance

Financial institutions are eager to use the hybrid cloud as a productive workplace to achieve strategic goals. But as reported in our white paper, “Turning Regulatory Challenges of the Cloud Into Competitive Advantage,” firms must overcome three major cloud adoption challenges.

First, companies face different regulatory obligations in various geographies. Multinational organizations must map regulatory obligations to 26 different countries and jurisdictions as far-flung as Singapore, London and New York.

Second, cloud service providers (CSPs) often provide different levels of control in the cloud than in the data center. That leaves financial services firms to build the right controls to address how they store and use data and who can access it — wherever it is. Regulators express concern over the amount of sensitive information CSPs maintain, often without being subject to the stringent regulations that govern banks, according to Business Insider.

Third, financial services firms and CSPs need a common security framework. A major accomplishment was reaching a consensus among the consortium members on the Cloud Security Alliance (CSA) open source framework. Modifications make it possible to build a single framework that is fully integrated with risk management and cybersecurity controls.

Lay the Groundwork for Continuous Compliance

Our managed services solution helps answer these challenges with continuous compliance to meet requirements for workloads running on public clouds — not only for regulations impacting the cloud, but for the General Data Protection Regulation (GDPR), Financial Industry Regulatory Authority (FINRA), U.S. Securities and Exchange Commission (SEC) and other regulatory bodies. The solution was developed in three stages.

1. Build a Regulatory Database for All Geographies

A continuous compliance database maps to every regulatory authority around the world. The database also defines GDPR and other cybersecurity obligations. The service monitors changes and makes timely updates to an industry-standard cloud control framework and regulatory database.

2. Map All of the Regulations and Controls to Each CSP

Mapping to CSPs is critical to achieve a standard level of control and to meet or exceed controls financial services firms might use within their own firewalls. Our solution maps a standard set of controls to every CSP, whether it’s Amazon, Google, Microsoft or IBM.

3. Adapt the Solution to the Individual Financial Services Firm

Each financial services firm already maintains in-house controls. The managed services solution requires an adapter to map the standardized framework to the existing framework for each firm’s individual policies, standards and procedures.

Continuous Compliance in Action

One of the largest investment firms in the world recently implemented the continuous compliance managed services solution with impressive success. A team of back-office personnel previously spent each day combing the internet for new and changing legislation and determining the impacts on current controls. The employees made updates manually.

The work was painstaking, tedious, and labor- and time-intensive, but these compliance employees formed the firm’s frontline defense against regulatory risk. Our managed services solution will help enable the firm to reduce its staff while saving substantially on compliance and reducing the risk of regulatory fines and reputational damage.

Automate Compliance With Cognitive Computing

Compliance is not a one-time event, but rather an ongoing process of monitoring and maintaining. Automation and cognitive computing — including artificial intelligence (AI) and machine learning — are the engines behind better, more efficient cloud governance.

In the future, the continuous compliance service will use Watson for RegTech. Watson will initially ingest existing regulations. Then, Watson will not only identify changes and update regulations, but also revise the controls that correspond with each regulation. Once Watson is fully trained, the time to add a new regulation or update an existing one will shrink exponentially.

Transfer to Other Obligations, Technologies and Domains

Financial services firms ultimately need to be in complete, real-time alignment with their regulatory obligations worldwide. Firms can access the industry-standard database to consume and adapt to updates for policies, requirements and controls while still maintaining their own firm-specific controls and processes. Our managed services solution mainly covers financial services regulations for cloud computing. Going forward, look for the scope to extend to regulations covering myriad technologies and domains to help financial institutions of all stripes overcome their greater cloud adoption challenges.

Read the white paper: Turning the regulatory challenges of cloud into competitive advantage

More from Artificial Intelligence

Tackling Today’s Attacks and Preparing for Tomorrow’s Threats: A Leader in 2022 Gartner® Magic Quadrant™ for SIEM

Get the latest on IBM Security QRadar SIEM, recognized as a Leader in the 2022 Gartner Magic Quadrant. As I talk to security leaders across the globe, four main themes teams constantly struggle to keep up with are: The ever-evolving and increasing threat landscape Access to and retaining skilled security analysts Learning and managing increasingly complex IT environments and subsequent security tooling The ability to act on the insights from their security tools including security information and event management software…

4 Ways AI Capabilities Transform Security

Many industries have had to tighten belts in the "new normal". In cybersecurity, artificial intelligence (AI) can help.   Every day of the new normal we learn how the pandemic sped up digital transformation, as reflected in the new opportunities and new risks. For many, organizational complexity and legacy infrastructure and support processes are the leading barriers to the effectiveness of their security.   Adding to the dynamics, short-handed teams are overwhelmed with too much data from disparate sources and…

What’s New in the 2022 Cost of a Data Breach Report

The average cost of a data breach reached an all-time high of $4.35 million this year, according to newly published 2022 Cost of a Data Breach Report, an increase of 2.6% from a year ago and 12.7% since 2020. New research in this year’s report also reveals for the first time that 83% of organizations in the study have experienced more than one data breach and just 17% said this was their first data breach. And at a time when…

Real Security Concerns Are Scarier Than Doomsday Predictions

The metaverse, artificial intelligence (AI) run amok, the singularity ... many far-out situations have become a dinner-table conversation. Will AI take over the world? Will you one day have a computer chip in your brain? These science fiction ideas may never come to fruition, but some do point to existing security risks. While nobody can predict the future, should we worry about any of these issues? What's the difference between a real threat and hype? The Promise of the Metaverse…