Money

A solid two-part article by Diana Kelley in Search Security called "Become compliant -- without breaking the bank":

Here's some good news: For most companies, the lion's share of tools needed to support control objectives for regulatory compliance are already in house. Before investing a single penny in new technology, assess the ability of what you already have.

A lot of the push-back from management comes from the fear of sticker shock. They have heard of other compliant soutions that have cost tons of money. here is your chance to play the hero--- take them a proposal that is cost-effective. They will be happy to take the credit for it :)