Policies must auditable - Having policies in place is a good first step, but they will not hold up to regulatory scrutiny unless there are audit trails proving the policy is in place and enforced on an ongoing basis. However, simply having an audit capability is not the solution. The sheer scale and diversity of systems in an enterprise require that tools are cross-platform. In other words, IT security staff must be able to provide reports that are consistent across all platforms and take account of the information produced by heterogeneous systems.
When you consider the amount of time and effort required to collect raw data from key systems and applications, including critical network devices, there can be literally hundreds if not thousands of logs that must be examined for the purpose of an audit report. This data needs to be converted into a standardized, audit compliant report format that can auditor can read.
So when youíre examining what options are open to you remember like your personal grooming options, donít expect miracles overnight, make sure you stick to the treatment regime, and most of all make sure that the results are there for all to see. So treat yourself for Christmas Ė Botox your policies before itís too late.