Compliance Churn Masks Security Gaps in Critical Industries

A quiet storm is brewing in boardrooms from Mumbai to Melbourne. A series of recent corporate announcements, superficially focused on governance and regulatory compliance, is drawing scrutiny from cybersecurity professionals who see a potentially dangerous pattern emerging. Dubbed the "compliance churn," this phenomenon sees companies in critical sectors—from sugar and petrochemicals to mining—publicly shuffling executives, appointing compliance officers, and initiating audits, all while potentially neglecting the underlying digital security foundations these measures are meant to oversee.

The Surface Activity: A Flurry of Governance Moves

In India, the activity is particularly pronounced. Sakthi Sugars Limited has convened its board specifically to review compliance requirements set by the Securities and Exchange Board of India (SEBI) for senior director appointments. Nearby, Mysore Petro Chemicals has announced the appointment of Saurabh Pandit as Company Secretary and Compliance Officer, a role pivotal for ensuring adherence to market regulations. Simultaneously, Sirohia & Sons Limited has taken steps to appoint both internal and secretarial auditors for the upcoming fiscal year 2025-26, signaling a focus on financial and procedural oversight.

This is not an isolated trend. Globally, mining giant Rio Tinto announced the departure of Isabelle Deschamps, its Chief Legal, Governance & Corporate Affairs Officer. Such high-level exits in governance roles can create significant knowledge gaps and disrupt the continuity of risk oversight frameworks, including those pertaining to cybersecurity and operational technology (OT) security in industrial environments.

The Cybersecurity Lens: Compliance Theater vs. Security Substance

From a security perspective, this churn presents a multifaceted risk. On one hand, strong corporate governance is a cornerstone of effective cybersecurity. A dedicated compliance officer and regular audits are essential components of a mature security program, ensuring accountability and alignment with standards like ISO 27001 or the NIST Cybersecurity Framework.

However, the danger lies in the potential for these actions to become a box-ticking exercise—a performative display of governance that satisfies regulatory checklists but fails to address core vulnerabilities. When boards are preoccupied with the mechanics of SEBI compliance for director appointments, do they allocate equal, rigorous attention to reviewing the company's incident response plan, its third-party vendor security, or the resilience of its industrial control systems (ICS) against ransomware?

The Blind Spots Created by Churn

The compliance churn can actively obscure critical security gaps in several ways:

1. Resource Diversion: Financial and human resources are finite. A sudden push to meet governance deadlines can pull skilled IT and security personnel away from proactive threat hunting, vulnerability management, and security architecture reviews to instead prepare documentation for auditors.
2. Leadership Discontinuity: The appointment of a new compliance officer or the departure of a chief governance executive often leads to a "ramp-up" period. During this time, institutional knowledge about existing security risks and mitigation strategies can be lost, creating windows of vulnerability. New appointees may lack the context or authority to immediately challenge existing security postures.
3. Illusion of Security: For stakeholders, including investors and partners, announcements of new audits and compliance appointments create a perception of robust risk management. This false sense of security can delay necessary investments in foundational security controls, such as network segmentation in OT environments or advanced endpoint detection and response (EDR) tools.
4. Supply Chain Opacity: Companies like Sakthi Sugars and Mysore Petro Chemicals are part of complex, critical supply chains. A focus on internal corporate governance paperwork does little to assess the cybersecurity posture of hundreds of suppliers and distributors, which are increasingly popular attack vectors.

A Call for Integrated Risk Governance

The solution is not to abandon compliance but to integrate it seamlessly with cybersecurity strategy. Security leaders must position themselves not as adversaries to the compliance function but as its essential partners. The goal should be to build a governance model where:

• Cybersecurity metrics are a standard part of board and audit committee reporting, alongside financial metrics.
• Compliance audits are leveraged as opportunities to validate and improve technical security controls, not just document them.
• Executive appointments in legal and compliance roles include an assessment of the candidate's understanding of digital risk and their ability to collaborate with the CISO.
• Internal audits for FY 2025-26, like those initiated by Sirohia & Sons, explicitly include scopes for IT general controls and cybersecurity frameworks.

Conclusion: From Churn to Resilience

The recent announcements across these diverse companies serve as a canary in the coal mine for cybersecurity professionals. They highlight a corporate world that is reactive to regulatory pressure but may be under-prioritizing the proactive, technical work of building digital resilience. The departure of a chief governance officer at a firm like Rio Tinto is a moment of significant risk and should trigger an immediate, thorough review of all risk oversight mechanisms, cyber included.

True security maturity is achieved when compliance is a natural byproduct of a well-defended, resilient organization—not the primary objective of a frantic governance shuffle. It is incumbent upon CISOs and risk managers to bridge the gap between the board's compliance checklist and the organization's security reality, ensuring that the flurry of activity in the boardroom translates into tangible safety in the server room and on the factory floor.