INFORMATION SECURITY-KNOW WHAT COMPLIANCE YOUR ORGANIZATION NEED
Data is the most critical part of any business. Every organization is either producing their own data or acquiring it from their employees or customers, so it becomes the organization’s responsibility to safeguard that data from unauthorized access. Digitization and digitalization has changed the working techniques of every organization. Almost all of the data is on information systems, which increases the risk of information exposure to the outside world .Many organisations already knows the importance of information Security and are working in a controlled environment one or the other way, however there are many organisations who still does not consider information security necessary for their business. Statutory and regulatory bodies has made information security mandatory for many businesses. Let’s discuss about different information compliances for organisations.
Why Organisations need IT Security Compliance
Compliance is a set of guidelines by the regulatory body which the organisation needs to adhere. Compliances brings great benefits for the organisations:
- Improvement in Information Security: IT security regulations improve organisations security measures by setting baseline requirements. This baseline requirements helps keeping business data-security levels relatively consistent within respective industries..
- Increase Control on Information Systems: Improved security goes hand-in-hand with increased control. This is helpful in preventing employee mistakes and insider theft with enhanced authentication mechanism while keeping an eye on outside threats.
- Minimize Organisations Losses: Improved security, in turn, prevents breaches, which are costly to businesses. There are many organisations which end up losing very large amount of their revenue in sales, repair costs and legal fees, all of which can be avoided with the right preventive measures
- Maintain Trust with customers:A better information security system definitely built and maintain customer trust. Customers trust organisations which keeps their information safe, secure and available at the right time.
There are numerous IT Security compliances exits each related to different industry verticals. The most common compliance includes
Health Insurance Portability and Accountability Act of 1996(HIPAA)
INDUSTRIES AFFECTED:This act affects any organisation or office that deals with healthcare data. That includes but is not limited to doctor’s offices, insurance companies, business associates, and employers.
WHAT HIPAA regulates: This act is divided into 5 titles.
Title I: It protects health insurance coverage of employees either they change job or laid off.
Title II: It controls health care fraud and abuse. It also establishes policies and procedures for maintaining the privacy and security of individually identifiable health information, outlines numerous offenses relating to health care, and establishes civil and criminal penalties for violations
Title III:This sets guidelines for pre-tax medical spending accounts.
Title IV:This sets guidelines for group health plans regarding coverage of persons with pre-existing conditions, and modifies continuation of coverage requirements
Title V:This governs company-owned life insurance policies.
General Data Protection Regulation (EU) 2016/679 (GDPR)
INDUSTRIES AFFECTED: This regulation impacts all the organisations which process personal data in any form. This includes any cloud service provider, marketing company, insurance provider, law firms, data analytics companies and many more. GDPR applies to all organisations collecting and processing personal data for people residing in the European Union, even if that organisation is not physically located or based in the European Union.
WHAT GDPR regulates : General Data Protection Regulation(GDPR) has 11 chapters’ general provisions, principles, rights of data subjects, controller and processor, transfer of personal data to third countries or international organisations, independent supervisory authorities, cooperation and consistency, remedies, penalties and liabilities, delegated acts and implementing acts, final provisions.
GDPR, motive is to protect personal data of European Union (EU)citizens from data breaches.
Payment Card Industry Data Security Standard (PCI-DSS)
INDUSTRIES AFFECTED:Payment Card Industry Data Security Standard (PCI DSS) is meant for all the organisations which handles credit card data.
WHAT PCI DSS regulates: PCI DSS has given a set of 12 regulations which are designed to protect customer credit card information and to reduce fraud. Compliance requirements pertaining to PCI DSS are: Build and maintain a secure network and system, protect cardholder data, maintain a vulnerability Management program, strong access control measures, regular monitoring and testing networks, maintain an information security policy
Sarbanes-Oxley Act of 2002(SOX)
INDUSTRIES AFFECTED: This regulation is meant for all U.S. public company boards, management and public accounting firms. In addition to this a number of provisions of the Act also apply to privately held companies, such as the willful destruction of evidence to impede a federal investigation
WHAT SOX regulates:Sarbanes-Oxley Act has eleven sections: Public Company Accounting Oversight Board(PCAOB), Auditor’s independence, corporate responsibility, enhanced financial disclosures, analyst conflict of interest, commission resources and authority, perform various studies and report their findings, corporate and criminal fraud accountability, white collar crime penalty enhancement, corporate tax returns, corporate fraud accountability.
According to this act organisations required to maintain financial records for seven years. It was implemented to prevent financial scandals like Enron.
The Federal Information Security Management Act (FISMA)
INDUSTRIES AFFECTED:Federal Information Security Management Act (FISMA) is for all federal agencies in the US. According to FISMA act all the federal agencies need to develop, document, and implement an agency-wide program to provide information security for the information and information systems. This also includes the information and information systems provided or managed by another agency, contractor, or other source.
WHAT FISMA regulates: FISMA defines a framework for managing information security of information systems. According to NIST FISMA is divided into: Inventory of information systems, categorization of information and information systems according to risk, implementation of security controls, risk assessment, system security plan, certification and accreditation and continuous monitoring
There are many other laws and regulations present to protect information. However it is not always very clear to the many decision makers or compliance officers which regulations or compliance is applied to their organisation. Compliance is very critical part of any business. Not adhering a mandatory compliance can lead to serious consequences, sometimes unnecessary disruption in the business. So this is very necessary for organisations to identify and understand all the desired regulations for the business and adhere to all the requirements of it.
#tags:SOX, FISMA, HIPAA, GDPR, regulatory
#keywords: compliance, SOX,FISMA, PCIDSS, HIPAA,GDPR, information security, data protection