In the quest for continuous improvement of business competitiveness, the
industry has now set its focus on a BPI (Business Process Improvement)
programme that can provide measurable benefits to a Company.
Six Sigma is one of the methodologies that is being practiced and essentially
is a conscious approach to near perfect operational efficiency. It aims at
identifying defects and rectifying them. It is a rigorous and disciplined
methodology that uses data and statistical analysis to measure and improve a
company's operational performance by identifying and eliminating "defects" in
manufacturing and service-related processes.
Cyber Law Compliancy (CyLawCom) as being advocated by Naavi.org is similar to
and perhaps be considered as one part of the Six Sigma approach covering the
defects that arise out of non compliance of the legal aspects of Computer
business.
The experiences of Radiant Software, Polaris, I Flex, Elcomsoft or Napster
bears fruit to the fact that negligence of legal compliancy in business could
have disastrous financial consequences.
Unlike the Six Sigma Core approach which quantifies the number of defects and
tries to minimize them, CyLawCom is to be treated more with as a qualitative
assessment. It is often not the number of Cyber Law Non Compliance incidents
that pose a danger to business continuity or profits. It is the nature of non
compliance.
The undersigned recently came across an incident where certain aspects of
CyLawCom negligence lead to a staff member picking up a key software tool
developed by the Company and pass it on to a competitor. One single incident
of this nature could cost a Company enough to drive it out of business.
We often encounter a question amongst IT managers about ROI (Return on
Investment) of a Cyber Law Compliancy programme. The ROI in case of the
above Company if it had implemented a proper CyLawCom programme would have
been perhaps around 500 % pa.
ROI of a CyLawCom programme should be looked at as we see the ROI of
"Insurance". Let us take "Medical Insurance" for a person of age 30. If he
carries a hospitalization policy and maintains it regularly say for the next
thirty years paying an average premium of say Rs 2500 per year, he may be
spending Rs 75000/- over a period of 30 years. However the probability of
incurring a hospitalization expenditure of around say Rs 3 lakhs during this
period is nearly one, making it a 400 % ROI (Gross) investment.
Similarly, a Company should consider a long term perspective of at least 10
years and estimate the probability of its legal negligence crystalizing into a
financial liability and then evaluate the ROI of its CyLawCom programme.
Obviously, the probability of the CyLawCom programme providing complete
protection against any liability also cannot be one. But even at a lesser
level the savings achieved could be enough to provide the right ROI. Taking
examples of Napster or Radiant Software both of whom had to sell themselves
out to survive, it is clear that the cost of CyLawCom negligence could be
placed at 100 % of the discounted turnover of next 10 years of the Company.
A quick glance around the industry can indicate that there are many small ,
medium and large Companies and Banks who are merrily carrying on their
E-business in India with several CyLawCom risks left unattended. One never
knows when they will be hit and when that day comes, all the stakeholders
would regret their negligence.
Cyber Law Compliancy haw three major segments, namely,
1. IPR violations
2. Digital Contracts
3.Due Diligence
IPR violations are easily understood and covers the avoidance of using Pirated
software or violation of Licensing terms of a software. The other two segments
however are not so easily understood and Companies are likely to commit far
more mistakes in these segments due to ignorance than in the IPR area. IT
users must understand that every "Mouse Click" or a "Key Board Tap"
particularly while on a website is a potential signature to a commitment.
There could be hidden contractual obligations behind such clicks and taps.
Similarly, every Network manager should realize that he is the custodian of
"Due Diligence" in managing the Network from the point of view of Cyber Law
Compliancy and any lapse on his part can land his Company into losses and put
his job at stake.
In order to start its CyLawCom process, Naavi.org advocates a AAA Enterprise
training programme covering
Awareness Creation about Cyber Laws
Application
of Cyber Laws in day to day business
Absorption
of Cyber Laws into the Business Strategy
Steps taken in this regard could well be significant strides for a Company
towards Six Sigma Certification.
Naavi
January 15, 2003
(Comments are Welcome)
