Regulatory compliance is a form of asymmetric warfare. It will always be faster and cheaper for Congress to create new regulations than it is for businesses to comply with them. After all, the infamous Section 404 of the Sarbanes-Oxley Act is only a few sentences, but carries an enormous punch.

Regulations also often have unintended consequences. Some, like SOX-404 are interpreted conservatively by auditors leading to high costs of compliance. Others, like California’s Database Breach Notification Act (SB1386), shine a powerful spotlight on identity theft forcing companies to notify those affected by a data breach. While identity theft has almost certainly risen in the last decade, the main reason for the publicity surrounding identity theft is the adoption of SB1386 and the resulting flood of disclosures. The reputational damage that comes with the forced publicity of a data breach has created the most powerful incentives for stronger information security. “Stay off the front page of [insert daily newspaper]” is a common mantra for IT executives while benchmarking security in the enterprise.

When asked how much they spent on compliance, most IT executives say they don’t know, since there isn’t a separate budget under which such things are tracked. Most are sure it isn’t small change. “A nice little bundle,” as the security architect at a transportation company puts it; “an absurd amount,” says the security manager at a bank.

IT executives, however, certainly know which parts of the regulatory landscape are costing them the most. When asked for the five costliest regulations they had to deal with, hardly anyone had to think long before answering. Somewhat surprisingly, despite the volume and intensity of griping about it, SOX is not the most onerous regulation. That honor goes to the various vertical-specific federal regulations such as the Health Information Portability and Accountability Act or the Gramm-Leach-Bliley Act. In a recent security benchmark, the specific regulations are called out as most expensive nearly 37% of the time, as opposed to just over 26% of the time for SOX.

Of course, when security processes, auditing and reporting are improved in an organization, those improvements can be mapped to many different regulations. The use of security practice frameworks, including the Control Objectives for Information and related Technology and ISO17799, is growing rapidly — most large companies are at least looking at frameworks, even if they aren’t formally adopting them.