DIT 8214 Week 4 DQ: Compliance with Regulatory Requirements

Student name

Capella University

DIT-8214

Professor Name

Submission Date

Compliance with Regulatory Requirements

The organization, through various integrated systems and automated processes, can use technology as a main facilitator for the regulations. The company has its centralized compliance management platform, where real-time adherence to information security policies is followed, and the activities of the employees are traced, as well as potential violations are alerted before they worsen. Multifaceted data analysis software can be used to identify the tendencies of non-conformity and assess the level of risk in different departments and geographical areas (Odetunde et al., 2022).

It has also implemented the automated training programs, providing businesses with periodic updates about the security policy and regulatory requirements, the successful accomplishment of which is monitored by our learning management system (Hatzivasilis et al., 2020). Security information and event management (SIEM) systems are also employed by the organization, allowing 24/7 monitoring of the network activity, alerting the administrators in case of breaches of set security standards, and taking preventive and detection measures, as recommended by Niemi (2023), to guarantee active compliance with the board of directors.

Among the 60 variables Sommestad et al. (2014) determined, the attitude towards compliance is one of the most powerful predictors, with effect sizes of 0.15-0.64 depending on studies. This variable can be observed in our organization in terms of the extent to which the employees feel that the security policy compliance affects them in a positive and not a negative manner. The organization has also observed that when the employees have a perception of the information security policies being in the best interest of the organization and their personal interests, then the employees are more likely to adhere to the policies.

Among the methods through which the organization undertakes it is by ensuring that security measures are not imposed in the form of restrictions, but as a way of safeguarding the data of workers and the company property. The motives of security policies are constantly conveyed by the leadership, as it is necessary to emphasize how compliance contributes to avoiding the violation of information, which can result in information disclosure to employees and the transfer of responsibilities to customers (Sommestad et al., 2014). The strategy is appropriate to the research finding, whereby the emotional and attitudinal variables have higher chances of predicting compliance than the entirely rational or punishment-based approaches.

Subjective norm is another variable that is significant to our organization, and that explains the perceived attitudes of coworkers and bosses related to compliance and has a weighted mean effect size of = 0.28 in seven studies (Sommestad et al., 2014). We make it a culture whereby security-conscious conduct is more evidently recognized and rewarded, creating peer pressure that is more likely to develop compliance, not viewing policy violation as an easy way out. Information security has an awareness level with an effect size of 0.31, which is the knowledge of the employees regarding the rules and regulations of the security that our organization applies through the intensive onboarding and continuous education programs (Sommestad et al., 2014).

These programs not only entail policy dissemination, but also actual scenarios, imitated phishing, and sensitizing about the problem of information security via frequent security advisories. Regularly updating these scenarios to reflect current threat landscapes ensures their continued relevance and effectiveness. The subjective norms are socially influenced, and the knowledge enhancement of the awareness programs is combined to create a reinforcing loop because the educated employees influence their colleagues positively and the compliance of the entire organization to a greater extent. With the focus on this form of soft variables and not focusing on the deterrence systems like sanctions, the organization in question can be defined as pursuing a pull and not a push approach to compliance (Sommestad et al., 2014).