Who would make an effective Compliance official in an organization? is a question that troubles many in the management.
In large organizations, there is no dearth of people or capacity to appoint professionals and hence there could be several persons with different designations trying to work on Compliance. There could be a Chief Privacy Officer and CISO working along with a Chief Compliance official with each commanding a team under them. But most companies donot have that luxury and have to meet the legal obligation nevertheless with some body doubling up with “Additional Charge”.
HIPAA-HITECH Act mandates that a person should be designated as “Privacy Compliance Official” and “Security Compliance Official” and his contact should be available on the website 24X7.
ITA 2008 mandates that there should be a “Grievance Officer” under Section 79 who faces the customers and a “Compliance Contact person” facing CERT-IN or Ministries of Finance and Home for being available for responding within 2 hours if need be.
Cert-In is a quasi judicial body which can order legal action in case of non compliance while other agencies may initiate action under other legal provisions.
The Compliance official is expected to be the nodal person to interact within the organization and be answerable to the regulators. He needs to have the skills of PR to deal with the regulators and people within though on the face of it the function seems to be a legal role.
In such a scenario, the questions that trouble most managements of small organizations is how do I assign the responsibilities of compliance within my existing team members whose core activity may be either IT or Software programming with no exposure to law. There is no doubt that they can take the assistance of external consultants for understanding ITA 2008 compliance requirements but ultimately some body under the roles of the organization needs to be designated as a “Compliance Official”
Compliance is an activity which starts from the zero day of a company’s existence. Hence even when a Start Up entrepreneur starts his initial work, and launches his project in a low key controlled public release he needs to have a compliance official. In case the entrepreneur fails to designate a person, the CEO himself becomes the compliance official. Since the CEO needs to focus on other business needs, it would be wise that he designates some body who works closely with his team and is present in the office all the time to act as a Compliance official rather than taking over the responsibility himself even though the buck ultimately stops with him.
In circumstances where the CEO works only with a team of software programmers and no body else to assist him, it therefore becomes necessary for one of the software developers and ideally the Team Lead to be also designated to be the Compliance Official.
If a CEO proposes that the person whom he has recruited for his software development expertise should also be designated as a “ITA 2008 compliance official” or a “Grievance Redressal official”, the software professional would in many cases not be comfortable since he thinks that he is not a “Legal Person” and hence “Compliance” does not sit with his designation properly.
However, it is time that software developers realize that basic knowledge of Cyber Law is today an essential knowledge for all IT workers and without it, they are likely to be challenged in their career progress. We often talk of “Privacy by Design” and that only means that the person who thinks of software architecture and coding should have some basic awareness of what his software is expected to do when it faces a client.
Today if we have many “Zero Day vulnerabilities” that pose a threat to Cyber Security, the main reason is that the software developers out their ignorance have not taken care of security at the time the software was designed and constructed. It has been an after thought which leads to compromises and creates security holes.
It is therefore felt that in smaller organizations, there is nothing unnatural in a software team lead to be additionally designated as “ITA 2008 compliance Official” and persons with such responsibility should consider themselves as premium professionals. It goes without saying that they need to understand their responsibility and discharge it faithfully.
I would advise software professionals to go through a quick online course if necessary (check apnacourse.com for course of Cyber law college) or take up more formal courses if time permits to equip themselves with some basic cyber law knowledge that enables them to work with an external consultant when required and discharge their responsibilities as a compliance official. The knowledge may also enable them to improve the quality of their software since the software by design would be “compliance ready”.
So, the new slogan that we need to pursue in software circles is “Compliance By Design” and I hope the software community raises to this requirement which actually helps the cause of Cyber Security.
This should reduce the incidence of “Zero Day Vulnerabilities” and the cost of maintaining “Bug Bounty Programs” along with the cost of Cyber Insurance coverage for user organizations.
Naavi
