Industry executives and experts share their predictions for 2023. Read them in this 15th annual VMblog.com series exclusive.
2023 Will Bring Application Meshing, More Industry Fines for Unmonitored Communications and a Laser Focus on Compliance in the Boardroom
By Devin Redmond, CEO and Co-founder, Theta Lake
In reflecting on the compliance trends that we saw in 2022, the need to implement a modern approach to compliance and security across modern unified communications (UC) platforms like Zoom, Microsoft Teams, Webex by Cisco, RingCentral, and Slack has never been more present.
Companies that take the extra step to ensure the platforms their employees and customers are communicating on are both compliant and secure will position themselves ahead of the anticipated increase in scrutiny and subsequent regulatory fines they may be faced with in the new year.
Below are ten key compliance and security trends organizations should keep an eye out for in 2023.
1. Firms will embrace UC tools to gain competitive advantages. As part of the digital transformation, IT budgets will favor voice, video, chat, whiteboard, document, and project tools that improve productivity, connectivity, and information sharing as well as customer acquisition and experience. These investments and ROI expectations will drive the adoption of features currently disabled for compliance reasons, in Zoom, Teams, Slack, RingCentral, Mural, Webex by Cisco, and others. Meanwhile, firms that choose not to modernize their UC and compliance stacks and rely on policy-based controls in an attempt to block or manage the use of these core features will feel the pain of being judged by regulators, customers and competitors against peers that are already in the process of modernization. As a result, the growing gap between firms that embrace the full features of UC tools compared to those that try to prevent the evolution to UC will begin to show in the improved topline, bottom line, and compliance of the former over the latter.
2. There will be an accelerating feature enablement race to improve compliance. It is already clear that firms choosing to disable features in Microsoft Teams, Zoom, Cisco, RingCentral, and Slack face a continued escalation of non-compliance, record-keeping gaps, and audit issues as employees and customers circumvent unenforceable bans by adopting unmonitored applications such as WhatsApp for productivity needs. As a key part of future feature enablement, firms will look to integrated communication suites with rich mobile capabilities, including SMS, to drive employees to engage and communicate on dynamic platforms enabled by modern supporting compliance controls. Strategically, this shift by IT, UC and compliance teams towards getting engagement and usage of compliant UC tools will improve compliance, and reduce the incidence of employees circumventing blocks to use off-channel platforms.
3. Fines for unmonitored communications will extend across sectors and geographies. The over $2 billion in fines imposed on U.S. banks for failing to capture chat communications are the thin end of the wedge for regulatory focus. Firms from all sectors and all geographies should be prepared for regulatory scrutiny of their ability to capture, monitor, retain and retrieve all relevant communications. From the UK Information Commissioner’s call for a review into the UK Government’s use of private messaging apps to the reported U.S. federal agency scrutiny of private equity and asset management firms, there’s no slowing down of investigations into record-keeping failures.
4. Individual accountability will make communications compliance a boardroom priority. As the regulatory scrutiny on communications intensifies alongside ever-escalating fines, we can expect to see senior individuals facing the personal consequences of a failure to comply, putting the spotlight firmly on the compliance and security of unified communications powering today’s modern workplace. Firms themselves have already taken actions ranging from demotions, loss of bonuses, or exiting of individuals. And that loss of bonuses includes board members voluntarily foregoing some of their variable pay in acknowledgment of the recordkeeping failings. The more than $2 billion in fines already imposed mandate a compliance review to examine individual conduct – it is entirely possible that there will be a future liability for (senior) individuals. Strategically, organizations now need to move from simply enabling a hybrid modern workplace with UC tools to ensuring compliance and security are front and center for all communications.
5. Video everywhere, for everything. The use of video will continue to accelerate in line with regulatory expectations for firms to be much more proactive in their approach to compliance. The reach of video is vast, from Zoom Rooms at AMC theaters to wealth advising, healthcare, education, and global cybersecurity coordination. That ascent as the predominant mode of communication is supported by the results of Theta Lake’s fourth annual survey report which found that 63% of organizations use video as much or more than email. 78% of respondents in financial services anticipate regulators will increasingly expect firms to monitor video communications. Organizations need to be aware that modern tools will need to be deployed to enable the capture of all relevant videos (mobile expressly included). In addition, firms should expect increased regulatory oversight and interest in the use of video and be able to explain the rationale for their compliance approach.
6. UC compliance will expand outside of regulated users. Firms will seek to mitigate growing compliance and security risks by expanding their capture and oversight of communications beyond directly regulated activities. A point reinforced by Gartner’s planning assumptions: By 2025 “35% of enterprise customers will archive workstream collaboration and meeting solutions for nonregulated requirements, an increase of more than sevenfold from 2021.” Indeed, we anticipate at least three new high-profile instances of poor record-keeping, data exposure, insufficient supervision practices, and legal proceedings due to conduct issues and lack of compliance coverage for UC environments. The approach to oversight and governance is and will continue to be, a key element of an organization’s stance on the management and mitigation of conduct and data privacy risks.
7. Unified communications will continue to cross-pollinate. The concept of application meshing will continue and become widespread. Using Zoom within Slack is an example of meshing in unified communications and more of these integrations will develop. This will have a profound impact on regulatory compliance, as compliance teams will be challenged to identify potential risk and policy violations as communications cross modalities (voice, video and text) and across ingrained application usage. Firms need to be prepared for not only the sheer volume of communication and the need to be seamlessly connected but also the need to be vigilant in the need to plug gaps as cross-pollination evolves.
8. UC and compliance team strategies will align. With modern unified communications underpinning all of today’s business, the need for compliance and UC teams to work together in lockstep will be key. Together teams will be strategically aligned on unlocking essential functionality (such as webcams, whiteboards, chat, and mobile), ensuring regulatory obligations are met, and enabling employees and customers to communicate on preferred channels. Both UC and compliance will need to assess their skill sets – it is likely that the next generation of compliance officers will need to develop their technology skills and the UC team will need to familiarize themselves with regulatory expectations and the firm’s approach to risk management.
9. The continued ‘return to office’ will accelerate mobile app usage. A return to the office has meant a return to travel, being on the go and being in touch anywhere and anytime. As a result, chat and video support on mobile devices across UC platforms will be increasingly critical as organizations seek to support employee functionality regardless of geography. UC and compliance teams will need to implement a robust joint strategy to enable mobile apps as users will demand full feature support (such as meeting chat and file sharing). As a matter of course the oversight of all aspects of mobile app usage should be included in monitoring plans.
10. Organizations will demand control of all of their data. The emerging reality is that firms are changing their approach to data. Organizations now want to host and control data centrally and securely using universally accessible cloud storage infrastructure. Cloud-native platforms offering modularity, flexibility, and simple UC application integrations will be the first choice of privacy-focused, budget-conscious firms. As the volume of dynamic chat, voice, video, and text data exponentially increases, accessing, searching, and retrieving this data will be more important than ever. Whether for forensics, financial reporting, internal investigations, or litigation, the ability to understand the contents of complex communication data, organize it, and retrieve it will need to become a core competency. Any inability to manage data could have profound regulatory and other, more damaging, consequences.
As organizations map out their compliance and security plans for the upcoming year, it’s essential that they remain nimble and adaptable to whatever 2023 may bring. By looking out for these trends in the coming year, businesses can better prepare themselves to not only tackle today’s challenges, but also thrive in the future.
##
ABOUT THE AUTHOR
Devin Redmond is co-founder and CEO of Theta Lake, a leader in delivering modern collaboration and security compliance. Devin is a two-time founder, and multi-time public company executive with over 20 years of experience in security & compliance technology. He has designed and delivered more than 10 category-leading products and helped some of the world’s foremost software companies grow and innovate, including Check Point, Neoteris, Websense, and Nexgate (Acquired by Proofpoint). Devin is a frequent speaker and press contributor, appearing on CNN, CBS, Forbes, and more. In addition to holding two patents, he’s lived in seven countries and speaks three languages.
