Security Compliance Is Not the Same as Protection | Opinion

Security compliance and protection are not synonymous terms, despite being frequently used interchangeably. Since the end of World War II, American security policy has followed a predictable cycle: a threat emerges, officials formulate a policy, secure funding, and implement countermeasures. However, this method is insufficient in today's fast-paced technological advancements.

Security standards of the past are no longer adequate and can leave government agencies, defense contractors, and sensitive information vulnerable. This issue affects not just the intelligence sector but also critical national services. In May 2024, the Environmental Protection Agency reported that over 70% of community water systems it had inspected since September 2023 were not fully complying with federal risk-assessment and emergency-planning requirements.

Inspectors also identified cybersecurity weaknesses, such as unchanged default passwords and shared staff logins.

Having worked in the security industry for nearly 45 years, the rapid shift in the industry is unprecedented. Artificial intelligence, open-source intelligence, 5G, 6G, drones, encryption, and quantum computing are all reshaping the landscape, and none of these technologies remain static. Many security standards were designed to address old adversaries and their tools.

Success is often measured by checking every box in these outdated standards, rather than ensuring enhanced protection. Secure facilities today are still designed to protect against physical threats, but risks can also come from connected devices, wireless signals, and new digital tools. The core problem lies in the fact that meeting standards does not guarantee success; it is not the same as being protected.

Rigid checklists can make it difficult for small-scale contractors to secure government work. The cost of compliance can also create an unfair competitive landscape for small contractors, who may need to spend thousands of dollars even if it is not relevant to the risk. Moreover, government officials who enforce compliance often lack the necessary technical understanding and may be vulnerable to private companies offering better pay and benefits. This can lead to flawed assumptions that may only become apparent after the policy is in use.

The solution is not to dismantle existing security standards but to make them more flexible. Security standards must be reviewed frequently, ideally on a monthly basis, rather than annually. These reviews should involve existing threat intelligence, technical experts, and operational security professionals, rather than only policymakers.

Every review and final policy must be tested against two criteria: whether it stops the actual threats and whether it is worth the cost. If we continue on the current path, organizations will continue to mistake paperwork and rigid standards for protection while overlooking real vulnerabilities. This could result in disruptions that affect multiple systems, potentially putting sensitive information at risk, which cannot be undone once released.

By addressing these issues, security could become more cost-effective, with agencies investing in actual risks rather than irrelevant ones. Critical services would proactively address known weaknesses before threats materialize, and small contractors would have a fairer chance of competing for government work. Establishing expert working groups to address issues, plan for future actions, and educate leadership on current security countermeasures is essential.

Collaboration between government agencies and industry experts is crucial to ensure Americans can sleep peacefully knowing they are protected against today's threats, not yesterday's.