Summer 2025
2025 IT Risk and Compliance Benchmark Report
Beyond the Benchmark:
How Does Our Report Compare?
A Publication by
Scroll to Begin
Unlock the Full Report
About this Report
Each year, The 2025 IT Risk and Compliance Benchmark Report takes a deep dive into market trends in the GRC space to help you prepare for the year ahead. This year, we uncovered several surprising gaps between cybersecurity industry ideals and operational compliance realities today. To present the most well-rounded perspective of these findings, we took things one step further: we compared our data against reports from Accenture, BDO, PWC, KPMG, IANS, EY, Deloitte, Coalition, Forrester, and the CISO Society so that compliance officers, CISOs, and compliance professionals can understand how their current methods compare against industry best practices.
Top Findings in Numbers
Top Finding 1
Only 17% of organizations adhere to country-specific data security/privacy laws despite their growing prevalence
Why this matters
This contradicts the assumption that regulatory compliance is a universal priority. Based on this data, most organizations appear to be ignoring localized requirements despite legal obligations.
Top Finding 2
76% of CISOs report that regulatory fragmentation significantly impacts compliance efforts
Why this matters
This challenges the idea that mature organizations have solved cross-jurisdictional compliance, showing even sophisticated programs struggle with regulatory complexity.
Top Finding 3
94.2% of CISOs agree that continuous controls monitoring improves security and compliance, but only 72% have implemented such tools
Why this matters
This gap is primarily caused by budget constraints, legacy technology integration challenges, and organizational resistance to process changes to support automation. The disconnect between aspiration and implementation reflects the larger struggle that CISOs and compliance officers face when transforming theoretical security improvements into operational reality within modern enterprise environments.
Top Finding 4
While 82% of organizations believe they effectively assess control effectiveness, 45% of board directors still seek external validation
Why this matters
This exposes a fundamental trust gap between technical teams and governance leadership that contradicts claims of aligned security assurance. CISOs believe in the value of these assessments, even when board members don’t.
Access the report
Want to learn more? Unlock the complete 2025 IT Risk and Compliance Benchmark Report for free.
Top Finding 5
52% of audit committees have primary ERM oversight, while 40.4% of organizations lack centralized systems for risk management
Why this matters
The absence of centralized risk management systems in over 40% of organizations highlights a governance gap that requires greater cyber literacy among board members to effectively interpret fragmented risk data and make informed oversight decisions in the absence of including cyber risks as part of enterprise risk management.
Top Finding 6
84% of organizations have aligned risk management with compliance, yet only 44.1% report full synchronization
Why this matters
This reveals a significant gap between theoretical alignment and practical integration, challenging claims of mature GRC programs. When only 44.1% of organizations have fully synchronized risk management and compliance, this means the majority of CISOs are essentially operating with partial visibility.
Top Finding 7
53.7% of CISOs report compliance is not embedded in development pipelines, while 15% of organizations lack any automated risk monitoring tools
Why this matters
This challenges what vendors are saying about DevSecOps maturity and security-by-design implementation. The disconnect between development pipelines and regulatory requirements creates potential compliance blind spots that increase organizational risk exposure.
Top Finding 8
42% of organizations struggle with data and system silos, creating fragmented risk management approaches
Why this matters
This confirms what practitioners have experienced for years. CISOs cannot effectively communicate organizational risk to senior leadership or the board when working with fragmented data sources that tell conflicting or contradictory stories.
Top Finding 9
47.9% of organizations struggle with evidence gathering, while 40% find audit-related tasks tedious and time-consuming
Why this matters
This reflects the reality that evidence validation remains a time-consuming, manual process in most organizations. Manual collection can create bottlenecks when subject matter experts must pause security work to provide documentation, and increases the likelihood of human error in evidence collection and submission for audits.
