Is IT Compliance A Profession? A Workshop on Refining Our Common Body of Knowledge, Skills and Ethics Peter T. Davis Principal Peter Davis+Associates

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 1 The Need Is compliance a profession or a job? Is there a need for a certification? Should the ITCi offer the certification? Or should they partner with someone else?

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 2 Professional Requirements Professions require 1.Code of Ethics 2.Body of Knowledge 3.Testing on the body of knowledge 4.Regulation

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 3 Qualifications Experience —Years —Disciplines Exam Code of Ethics Sponsor Grandfathering?

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 4 COMPBOK What is included in the Body of Knowledge? What will we call it? Do you think people would respond to a survey on job specifications? Should ITCi go for ANSI certification?

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 5 Suggested Table of Contents Management principles IT Governance Laws and regulations Records management Ethics Security Privacy Risk management Control self-assessment Investigations Performance management

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 6 Management Principles Processes and Business process mapping Controls and testing Plan  Organize  Staff  Direct  Control and PDCA/PDSA and DMAIC/DMADV Organizational and committee structure Marketing; influence without authority Budgeting Awareness and training Policy framework

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 7 IT Governance C OBI T ITIL ISO M_o_R CRAMM MSP PMBOK PRINCE2 CMMI Six Sigma

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 8 Laws and Regulations Legal concepts, e.g., evidence, eDiscovery Which ones? —SOX/Bill 198 —HIPAA —GLBA —PCI DSS —Privacy —Electronic evidence; e.g., FRCP

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 9 Records Management Legal requirements Guidelines Record retention policy Retention schedules Enabling technologies

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 10 Ethics “Tone at the Top” Legal and regulatory requirements Ethics topics Ethical fallacies and dilemmas Code of Conduct Ethics plan

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 11 Security CIA Compliance tools

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 12 Privacy Concepts Privacy enhancing technologies, i.e., PET

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 13 Risk Management Concepts Definitions Process Quantitative vs. qualitative

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 14 Control Self-Assessment Concepts Techniques Surveys

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 15 Investigations Organization Incident handling Forensics Reporting

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 16 Performance Management Process Definitions Metrics Reporting Maturity model?

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 17 Solicitation Would you like to help?

IT COMPLIANCE CONFERENCE 2007 | Your Presentation Title Goes Here—To edit, go to View>Header and Footer P. 18 Questions and Answers

Contact Information Peter T. Davis, Principal Peter Davis+Associates Please Complete Your Session Evaluation