Thu, Jun
4 New Articles

Compliance Without the Complexities

Security - Other
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Knowing what to do--and what not to do--can help you get into compliance and stay there.


Editor's Note: This article is an excerpt from "Compliance Without the Complexities," a free handbook that you can download from the MC White Paper Center.

The purpose of this article is to highlight the various aspects of compliance, specifically how to attain and maintain compliance. Many organizations have attained compliance, but a common complaint we hear is that maintaining compliance takes too long and costs too much. Through the practical experience of helping our clients--both large and small--attain and maintain compliance, we have built up a treasure chest of tips and techniques to help every organization address its compliance needs.


This article touches on the issues underlying compliance and highlights what areas of expertise you must develop to achieve compliance and avoid falling out of compliance. A more detailed treatment of these issues, including tips for maintaining compliance--what we like to call developing and maintaining a "compliance lifestyle"--can be found in our free handbook, "Compliance Without the Complexities." This article is based on material found in the handbook.

Determining What Compliance Means

One problem facing many of you is determining what compliance actually means to your organization. We are bombarded with ads for products that will help us "be in" or "attain" compliance. But what does this actually mean?


Compliance is defined in one dictionary as "Conformity or acting according to certain accepted standards." Another definition is "Conforming to a specification, standard or law that has been clearly defined."


I think the problem for most of us is the phrase "...that has been clearly defined." In talking with many users, "compliance" is anything but clear.


The first task in your quest for compliance is to determine exactly what it is that your organization needs to be in compliance with.

Common Compliance Requirements

While laws and requirements continue to rapidly evolve, let's look at the more common compliance requirements affecting organizations today:

  • Payment Card Industry (PCI) Data Security Standards (DSS)
  • Sarbanes-Oxley Act (SOX) and similar bills
  • Worldwide financial sector
  • Canada
  • Individual states

Where to Turn for Guidance?

Because most of the laws and regulations are vague as to the actual specifications of how one actually achieves compliance, and almost none gives any implementation hints, organizations are turning to a variety of standards for guidance on attaining and maintaining compliance. Implementing your security configuration according to security best practices is the best method of proactively preparing your organization for attaining and maintaining compliance.

Defining Your Policies

I believe that all organizations have a policy, though for some it may just be in employees' heads. Why do I make that claim? Because when I work with our clients who don't have a written security policy and I ask them what their data access policy is--that is, whether users should be able to access application data outside of the protection of the application logic--they are always able to answer the question. I'm hoping that a discussion on security policies will help people actually get those policies down on paper, approved by management, and communicated to the organization. But just in case you still have some doubts, let's understand that a written security policy is a necessity. If an organization sees no other business benefit from having a formal security policy, they need to realize that having such a policy is required by many regulations, including the PCI's DSS and laws such as the U.S.-based Health Insurance Portability and Accountability Act (HIPAA).

Data Types and Security Requirements

Data--specifically the type of data and the actions that can be taken on that data--is the cause of every law relating to compliance. The type of data in your database files and tables determines the security requirements of the data. Therefore, the first thing I recommend people do is classify their data. You don't have to classify every field to be effective, but making an attempt to classify your data ensures that it will be handled appropriately. Things to define when you classify data include who (what roles) should have access to the data, how long data should be retained, what the disposal methods are, and whether data access is denied by default or read-only.

Reducing Your Risk

Regardless of what law or regulation is involved, its intent is to reduce risk to the data. For example, SOX addresses the need for data integrity, and PCI addresses the need to protect cardholder data. One of the methods for reducing your compliance efforts as well as reducing risk to data is to reduce the propagation of the data. Instead of subsetting personal information and propagating only the non-private information, companies often replicate entire files for use by other applications, copy the data into network file servers or data warehouses, or download it onto spreadsheets. By limiting propagation to only the non-private data, the risk to the private data is greatly reduced.

Encryption Considerations

One aspect you must consider when determining the scope of your compliance requirements is encryption. As most of us are aware, the PCI DSS has significant encryption requirements for both the transmission of credit-card information as well as cardholder data at rest. Other laws and regulations have requirements to encrypt the transmission of data over public networks, and some strongly encourage its use for data at rest. Finally, most of the breach notification laws have exemptions stating that if the lost or stolen data is encrypted, individual notification is not required.

Implementing Compliance Requirements

ISO17799, HIPAA, GLBA, and the PCI DSS all have specific requirements when it comes to user access. We discuss the concept of "least privilege" in our literature and explain how it pertains to accessing data. Another aspect of least privilege is the capabilities given a user. In i5/OS or IBM i, this translates into what special authorities are given to the user and what group profiles administrators place them in. Another security concept with which you should become familiar when considering compliance requirements is that of "roles" and "role-based" access.

User Management

Before looking at the various requirements dictated by laws and regulations, it's helpful to understand why proper user management is important. User management needs to be part of your routine system management processes. I believe that good user management requires that you have a process for creating new profiles, have a process for removing inactive profiles on a timely basis, require users to have strong passwords that are changed regularly, review user access to applications as well as the system itself, and make sure that users are not given more capabilities or access to system resources than is necessary to perform their jobs (at the very least).

Requirements That Drive System Configuration Settings

If you have read any of the compliance laws or regulations, you know that they are not so detailed as to spell out the exact settings for each operating system and application. Rather, they are written using generic wording and aimed at such a level so as to apply to any operating system and application. Some translation must occur from the wording of the various laws and regulations in order to know how to properly implement each requirement on the operating systems and applications within your organization.

Preparing for Audit

If you know that an auditor is coming, you need to prepare ahead of time. Don't wait until the day the auditor shows up to attempt to get your processes updated or run the reports they may have already requested. You want to start impressing your auditor the minute he or she walks in the door. We discuss ways to impress your auditor in our literature, but you may wish to ask yourself why an auditor is paying you a visit in the first place.

Security Processes

A friend was recently in a compliance training seminar, and the speaker said that the primary reason many organizations were failing their PCI DSS audits is because they didn't have their policies and processes documented. Why not? They were focusing too much on implementing the technology! SOX auditors focus on having processes documented. Processes must be documented for several reasons, including to assure the auditor the processes are thought-out and understood, to show proof that an action has taken place, to observe the process is being followed, and to ensure consistency in how the process is being performed.

Creating a Security Incident Response Plan

The Boy Scout motto-always be prepared-is what comes to mind when addressing this aspect of security compliance. Many laws and regulations (including the PCI's DSS) require that a section of your security policy address the need for a security incident response plan. And isn't that something you'd feel more comfortable knowing you have anyway?

The Security Awareness Program

Beyond the fact that a security awareness program is a requirement of many laws and regulations, it makes great business sense to develop a security awareness program in your organization. Many security problems can be avoided by educating your employees about the ways they can help to ensure that the security of your data is not compromised.

What Is a Risk Assessment?

A risk assessment is a thorough analysis of the security configuration of your system. By running an assessment of your security configuration, you can determine what issues exist on your system. An assessment should include (at least) an examination of the object-level authorities, the TCP/IP configuration settings, the various user profile settings, the issues with adopted authority, the commands run by limited capability users, and the system value settings, to name a few. Risk assessments are required by some laws, such as HIPAA and GLBA, as well as the PCI DSS standards and ISO17799.

Security Is a Business Process

Once you have run an assessment, identified the issues, categorized them, put work plans into place, fixed the most critical exposures, and written your business risk acceptance statements, you may think that you are done. Unfortunately, security is not a one-time project. It's a business process that needs to be addressed on a perpetual basis. It's more a lifestyle--the "security compliance lifestyle."


To learn more about how your company can attain and maintain compliance, download the handbook "Compliance Without the Complexities."

Carol Woodbury


Carol Woodbury is IBM i Security SME and Senior Advisor to Kisco Systems, a firm focused on providing IBM i security solutions. Carol has over 30 years’ experience with IBM i security, starting her career as Security Team Leader and Chief Engineering Manager for iSeries Security at IBM in Rochester, MN. Since leaving IBM, she has co-founded two companies: SkyView Partners and DXR Security. Her practical experience and her intimate knowledge of the system combine for a unique viewpoint and experience level that cannot be matched.

Carol is known worldwide as an author and award-winning speaker on security technology, specializing in IBM i security topics. She has written seven books on IBM i security, including her two current books, IBM i Security Administration and Compliance, 3rd Edition and Mastering IBM i Security, A Modern, Step-by-Step Approach. Carol has been named an IBM Champion since 2018 and holds her CISSP and CRISC security certifications.

MC Press books written by Carol Woodbury available now on the MC Press Bookstore.

IBM i Security Administration and Compliance: Third Edition
Don't miss the newest edition by the industry’s #1 IBM i security expert.
List Price $71.95

Now On Sale

Mastering IBM i Security Mastering IBM i Security
Get the must-have guide by the industry’s #1 security authority.
List Price $49.95

Now On Sale



Support MC Press Online

$0.00 Raised:

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: