There are times in life when simply doing enough to get by is, well, sufficient. Other times, you know you need to go all in and compete to win. Top athletes, for example, know how and where to spend their time and effort. They don’t go all-out all the time, but they do know when to push hard, give it their all and set their sights on the podium — and a medal.

By contrast, an alarming number of organizations today are completely unaware that they are competing in a kind of data security triathlon. They are essentially sitting on the grass, looking up at clouds, unaware of the malicious insiders, uneducated users and cybercriminals creating risks and flying past them in a race to get to sensitive data.

Get in the Game!

Many organizations recognize there’s something going on, but they are unaware that they need to be in it to win it. Instead, they spend their time just doing enough: They make sure to check the compliance box and pass their audit, whether for PCI DSS, HIPPA, SOX or the EU’s GDPR, which goes into effect in June 2018.

While being in compliance is absolutely important and represents a great first step along the road to data security, it is merely sufficient. It helps avoid fines, scrutiny and other unpleasant things, but it does not position organizations to compete.

In this day and age, there seems to be a new data breach almost every day. Organizations must adopt a win-now mindset rather than simply doing enough to satisfy compliance requirements.

An organization can go for the gold by starting its data security journey with compliance and then intensifying its efforts and staying focused. This means successfully safeguarding data from internal and external threats. It also means being the champion and protector of your customers, your brand and the sensitive data that fuels your business.

Start With Compliance

The right place to begin is indeed with compliance. By starting with compliance, you become acquainted with the basics and can start learning the vocabulary of the data security athlete. Compliance helps you pass your audits, but it can also get you to start thinking about:

• Discovery: Where is the relevant data?
• Monitoring: Who is reading or changing that data, and how do I create an audit-worthy trail that I can share with auditors?
• Hardening: What do I need to do to secure the data repositories where the relevant data lives?

To help you simplify and speed your compliance efforts while keeping costs down, you should look for a solution that can support discovery, monitoring and hardening. It should be automated, with as much built-in functionality as possible.

Protect Sensitive Data

As you train for the data security triathlon, you also need to make sure your compliance solution can grow with your future needs, supporting discovery, monitoring and hardening but also protecting sensitive data.

Sensitive data — such as IP, customer or partner information, manufacturing information, proprietary algorithms and all those other types that are crucial for business success but are not covered by compliance mandates — is probably scattered throughout your environment in databases, the cloud, big data environments and file systems. You need to find this information and protect it with a variety of features that can thwart threats.

Key capabilities to look for include: data protection (masking, redaction, encryption, blocking, alerting, etc.) for data at rest and in motion; entitlement reporting; risk and threat detection, including real- and right-time analytics, cognitive analytics and specialized threat detection analytics; and broad platform support so that when you are ready, you can safeguard your sensitive data, wherever it resides.

Expand Your Data Security Vocabulary

You can now use your expanded data security vocabulary and capabilities to achieve better security. Further your aims by asking questions such as:

• Where is my sensitive data?
• How can I protect my sensitive data at rest?
• Who has access to my sensitive data?
• Do users have the right level of access, or should access be turned off?
• What must I do to secure my sensitive data repositories?
• What is actually happening to my sensitive data?
• How can I prevent unauthorized activities?
• How can I protect sensitive data in motion?

Expanding from compliance to data security should not be difficult, and you should not be confronted with technical sticking points. With the right training program in place and key considerations in mind, you can score a neat compliance victory and then expand your program, build on your efforts and continue your journey to the data security triathlon. There you will surely have your shot at gold.