20% of CISOs spend between $100,000 and $200,000 annually on compliance.

Only a fifth (20.5% of CISOs) said they have very little duplication in their compliance efforts.

Roughly half of CISOs (47.9%) cited evidence gathering as one of their greatest challenges in implementing new or updated compliance frameworks.

53.7% of CISOs pointed to skilled staff as a major challenge in implementing new or updated compliance frameworks.

38.3% of CISOs cited cost as a challenge in implementing new or updated compliance frameworks.

33.5% of CISOs cited audit management as a challenge in implementing new or updated compliance frameworks.

Many CISOs (51.6%) were impacted by their maturing compliance program as a challenge in satisfying regulatory requirements.

Nearly as many (46.3% of CISOs) think the technology will allow them to more rapidly apply governance.

Just over a quarter (27.7% of CISOs) think that automation will improve the ROI on existing tools.

Almost two thirds of organisations (63.7%) do not feel that meeting new regulatory requirements slow their organisational growth.

38% of respondents believed their legal/compliance privacy team was understaffed.

43.6% of CISOs cited control mapping as a challenge in implementing new or updated compliance frameworks.

25% of businesses cited changes in legislation and regulation as a key business risk.

Roughly one-sixth (15.8% of CISOs) endure quite a bit of duplication and 37.4% have some duplication in their compliance efforts.

34.6% of CISOs are challenged by regulatory change management in satisfying regulatory requirements.

Roughly 22.6% of CISOs rate their compliance program a 4 (“Adherence: measured with metrics to support audit and risk mitigation”), but only 5.3% believe their program is a 5 (“Optimized: continuous improvement and efficiency”).

Just 17.9% of CISOs are using GenAI tools within their compliance program.

More than four-fifths (82.1% of organisations) are not currently using GenAI tools or functions within their compliance program.

Two-thirds (66.3% of all CISOs) surveyed said that their organisation does not measure the operational cost of managing compliance.

Of the organisations that measure the operational cost of managing compliance, more than three quarters (75.4%) track all costs.