Practices for IT Regulatory Compliance