RegScale

38.5% of CISOs said GRC tools are too expensive.

Almost one-third (31.1% of CISOs) believe that their company’s resistance to change is primarily driven by financial matters.

75% of retail and consumer goods and 62.5% of entertainment and media corporations are coping with the lack of a centralized system, but retailers are also challenged by silos within their data (75%).

30.3% of CISOs are challenged by control mapping in satisfying regulatory requirements.

Roughly 50% of CISOs expect automation to optimize compliance through a single pane of glass.

25.5% of CISOs assume current GRC processes are not broken.

13.7% of CISOs said their compliance program is a 1 (“Initial: ad-hoc”), and 23% said their program is a 2 (“Established: documented and repeatable”).

More than a third (37.8% of CISOs) said their relationship between compliance and security is in a phase of simple negotiations.

69.7% of CISOs said cost is most important when selecting tools/vendors to provide governance and continuous controls monitoring.

53.2% of CISOs take note of their organisation's regulatory requirements.

66.7% of education businesses are challenged by audit readiness and their maturing compliance program.

230 million of the breached passwords met standard complexity requirements, including length, capitalisation, numbers and special characters.

30% of CISOs spend less than $100,000 annually on compliance.

Most organisations (57.9%) spend at least some of their budget on GRC tools to collect and maintain compliance evidence.

Of the organisations that measure the operational cost of managing compliance, 10.1% track IT costs.

76.1% of CISOs said integrations are most important when selecting tools/vendors to provide governance and continuous controls monitoring.

Almost half of the CISOs who rated their compliance programs a 1 or 2 attributed their difficulties to a lack of personnel or resources.

26.1% of CISOs cited the rate of regulatory change as a challenge in implementing new or updated compliance frameworks.

17.6% of CISOs believe that manual processes are easier than using Compliance as Code.

Just over 13% of CISOs are looking to technology to help solve their problems and have started to adopt or have plans to adopt Compliance as Code (OSCAL or OCSF).

35% of CISOs said that, on a scale of 1 to 5, they would rate their compliance program a 3 (“Defined: early-enterprise, standardized and structured”).

44.2% of CISOs consider security and compliance a business enabler.

Less than half of the respondents (44.1% of CISOs) described the relationship between compliance and security as completely synchronized.

One-third (33% of CISOs) see an opportunity to supercharge staff through automation.

Just over a quarter (26.4%) of CISOs said that compliance has been embedded into 26-50 percent of their pipeline, while 27.4% have embedded compliance in as much as 75 percent of their pipeline.

Less than one-sixth (14.2%) of CISOs have embedded compliance into the majority (76-100 percent) of their pipeline.

20% of CISOs spend between $100,000 and $200,000 annually on compliance.

Only a fifth (20.5% of CISOs) said they have very little duplication in their compliance efforts.

Roughly half of CISOs (47.9%) cited evidence gathering as one of their greatest challenges in implementing new or updated compliance frameworks.

53.7% of CISOs pointed to skilled staff as a major challenge in implementing new or updated compliance frameworks.

33.5% of CISOs cited audit management as a challenge in implementing new or updated compliance frameworks.

Many CISOs (51.6%) were impacted by their maturing compliance program as a challenge in satisfying regulatory requirements.

Nearly as many (46.3% of CISOs) think the technology will allow them to more rapidly apply governance.

Just over a quarter (27.7% of CISOs) think that automation will improve the ROI on existing tools.

Almost two thirds of organisations (63.7%) do not feel that meeting new regulatory requirements slow their organisational growth.

38.3% of CISOs cited cost as a challenge in implementing new or updated compliance frameworks.

43.6% of CISOs cited control mapping as a challenge in implementing new or updated compliance frameworks.

53.7% of CISOs stated that compliance is not embedded into their CI/CD pipeline.

Almost one in ten (9.6% of CISOs) said their relationship between compliance and security is in a period of complex negotiations while 8.5% said their relationship is out of sync.

Of the 1.8 million breached administrator credentials, 40,000 admin portal accounts had the password ‘admin’.

Roughly one-sixth (15.8% of CISOs) endure quite a bit of duplication and 37.4% have some duplication in their compliance efforts.

34.6% of CISOs are challenged by regulatory change management in satisfying regulatory requirements.

Roughly 22.6% of CISOs rate their compliance program a 4 (“Adherence: measured with metrics to support audit and risk mitigation”), but only 5.3% believe their program is a 5 (“Optimized: continuous improvement and efficiency”).

Just 17.9% of CISOs are using GenAI tools within their compliance program.

More than four-fifths (82.1% of organisations) are not currently using GenAI tools or functions within their compliance program.

Two-thirds (66.3% of all CISOs) surveyed said that their organisation does not measure the operational cost of managing compliance.

Of the organisations that measure the operational cost of managing compliance, more than three quarters (75.4%) track all costs.

Of the organisations that measure the operational cost of managing compliance, 14.5% track compliance expenses.

60% of manufacturers and 52.5% of software and IT services companies see the biggest barrier to adopting Compliance as Code is that no one is using the technology.

Roughly two-fifths of CISOs are challenged by evidence gathering (41.5%) as a challenge in satisfying regulatory requirements.