The compliance burden on critical IT staff can be crippling.Tracking the moving target of regulatory requirements is afull-time job for some, and seems to be a game of catch up ratherthan the proactive approach preferred by auditors andexaminers.

There is a process that can facilitate earlyidentification of emerging or changing risks in order to moreeffectively manage compliance requirements; the controlself-assessment process. Properly implemented, the CSA process isan extremely effective risk management tool.

Implementing a CSA process is highly recommended by the FFIEC,earning plenty of regulatory support with 43 mentions in seven ofthe 12 FFIEC IT Examination Handbooks. But the Information SecurityHandbook makes the most compelling argument for utilizing CSA inyour risk management program: