THE LATEST OPINIONS
FROM OUR EXPERTS

With an ever-growing web of domestic and international regulations, compliance has shifted from a periodic checkbox activity to a constant operational demand. For many organisations—especially SMBs - keeping up with frameworks like GDPR, NIS2, DORA, HIPAA, PCI and emerging data privacy laws is stretching internal teams beyond capacity. As compliance requirements scale, so too does interest in Compliance-as-a-Service (CaaS) as a scalable, cost-effective solution.In this article from News in the Channel, Tracey Hannan-Jones, Consulting Director for Information Security at UBDS Digital, contributed in explaining why compliance has become so complex and why outsourcing is increasingly the pragmatic choice for businesses navigating multiple frameworks. She highlights that internal compliance teams are often small and cannot keep pace with fast-moving regulatory expectations - especially as organisations shift to SaaS and cloud-first environments where compliance must be “responsive and scalable” to match operational agility.Hannan-Jones also emphasises the growing need for risk assessments, internal audits, and unified policy management, where a single well-designed policy can satisfy numerous frameworks at once. Outsourcing, she notes, allows organisations to reduce internal overheads while ensuring they meet SLAs, contractual obligations, and legal requirements with expert support.For SMBs in particular, she warns that compliance gaps are no longer minor operational issues - they are barriers to commercial opportunity.“For SMBs that need certifications to bid for work, it’s no longer enough for ‘someone’ to do their best,” she explains. “Compliance becomes a blocker to trade up.”As data breaches and regulatory scrutiny intensify, CaaS providers offer vital support through specialised tooling, monitoring, vulnerability management, and continuous oversight—helping organisations stay ahead of new laws rather than constantly catching up.

PCI DSS compliance is too often treated as a technical obligation rather than what it truly is: a critical business risk and trust issue. Paul Brennecker, Head of Information Security at 3B Data Security, argues that with payment data remaining a prime target for attackers, organisations must move beyond reactive, audit-led approaches to compliance.Paul highlights that many compliance failures stem from inconsistent control enforcement and poor visibility, particularly across hybrid and cloud environments. He stresses that PCI DSS should be embedded as a continuous operational discipline, supported by clear ownership, effective governance and security controls that reflect how businesses actually operate.When approached correctly, Paul believes PCI DSS becomes more than a regulatory requirement. It serves as a framework for improving security maturity, resilience and customer confidence, protecting both revenue and reputation rather than simply avoiding penalties.

The Information Security Buzz piece outlines a practical roadmap for organisations moving from simply managing risk to achieving digital resilience in-line with the EU’s Digital Operational Resilience Act (DORA). Rather than viewing DORA as just a compliance checklist, the article presents eight actionable steps that help firms embed resilience into governance, risk management, incident reporting and third-party oversight, ensuring continuity, regulatory alignment and stronger cyber posture in an increasingly hostile threat environment.Tracey Hannan-Jones, Compliance and Security Consultant at UBDS Digital, emphasises that successful DORA compliance begins with rigorous self-assessment and gap analysis, understanding whether and how an organisation’s operations, suppliers and technology footprint are subject to the regulation. She urges firms to treat compliance as a strategic resilience initiative, not a bureaucratic burden, by strengthening ICT risk management, enhancing incident reporting processes and building more robust third-party provider governance.Tracey also highlights that DORA’s reach extends beyond the EU to UK firms serving European clients, meaning many organisations must prioritise operational continuity, real-world resilience testing and proactive risk treatment now rather than later. For her, DORA isn’t just about meeting deadlines. It’s about operationalising resilience as an ongoing business capability that protects customers, safeguards services and reinforces trust.Read more about Tracey’s perspective and the full set of DORA-aligned steps in the article.