Ernst & Young: Information Security Driving Business Process Improvements - But Need for Continuous Attention to Minimize Risk

Business Wire, Nov 14, 2006

* More than half of survey participants confirm their compliance work is part of an integrated organization-wide compliance effort and risk management framework.

* Over the next year, after working on compliance and privacy, more survey participants say they will be working proactively to help their organizations meet global business objectives.

* Nearly 80% of survey respondents have identified and prioritized critical business processes as part of their business continuity plans; three quarters of them have undertaken an IT risk assessment in developing their plans.

* Nearly half of information security executives say they have adopted or plan to adopt an information security standard.

* Other areas for continuous improvement

* More than half of survey participants have yet to take steps to integrate information risk management into their overall risk management activities.

* Over 40% of survey participants indicate they are not reporting about information security issues to their board of directors and business unit leaders on a regular basis.

* Only half of organizations have their information security function proactively involved in achieving regulatory compliance.

* Information security is least proactive today when addressing new technologies.

* One-third of survey respondents say disaster recovery timescales have not been agreed to with the business, only half of business continuity plans have been tested, just over half of organizations have agreed on escalation procedures in response to a disaster, and less than half have developed an internal and external communication strategy for business continuity.