Post Menu and Details.
Words: 1016
Reading time: ~4 minutes
Compliance with federal, state, and local cybersecurity regulations is crucial for avoiding fines, data loss, and a tarnished reputation. For example, regulatory fines for GDPR violations have put many companies out of business.
Compliance puts you in a position to avoid preventable data breaches, malware attacks, and hefty fines. Do you know if you’re fully covered? If you’ve hired a managed cybersecurity team, you’re in a good position because they will help you protect your business and maintain compliance.
If you’re not working with an expert, here’s a list of 7 cyber security regulations you might be required to follow.
-
The new SEC cybersecurity rules
The U.S. Securities and Exchange Commission (SEC) recently approved new rules that require all publicly traded companies to publish the details regarding any kind of cyber attack they experience within four days of realizing the attack has material consequences. If the impact is material to investors, it must be disclosed.
Companies must disclose the nature of the attack, the scope, timing, and impact. The four-day rule can be extended for up to 60 days if publishing this information would “pose a substantial risk to national security or public safety.”
Additionally, publicly traded companies must provide an annual report on their cybersecurity risk assessment and management strategies, which includes the details of how each threat might impact the company and what is or has been done to remediate these threats.
-
HIPAA
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that governs the storage and use of private health information. This law applies to covered entities, which are defined as “health plans, health care clearinghouses, and healthcare providers who electronically transmit any health information.” This includes doctors, pharmacies, and hospitals, but also applies to others, like web hosts who store private health information (PHI) on behalf of a covered entity.
If you handle data for a covered entity, you must also be compliant with HIPAA. If you run a web hosting company, it’s best to prohibit the storage of PHI unless you intentionally run a HIPAA-compliant hosting environment.
-
The NIST cybersecurity framework
All federal government agencies in the United States, along with private businesses with government contracts, must be compliant with NIST SP 800-53. These regulations set requirements for data encryption, user authentication, and access control.
Too often, government agencies are hit with cyber attacks that expose private information, like Social Security numbers, phone numbers, email addresses, names, and home addresses. This information is sought after by cybercriminals to use for identity theft.
Some of the biggest government data breaches in history have exposed between 3.5 million and 191 million records. If you work for a government agency that isn’t compliant with NIST SP 800-53, and you’re a leader or manager, you may want to make some suggestions to avoid being named in a lawsuit after a breach.
-
The General Data Protection Regulations (GDPR)
The GDPR exists to protect data belonging to European Union (EU) citizens, and it applies worldwide. If you collect, store, handle, or process data from EU citizens, you must be compliant with GDPR.
This is where it gets a little tricky and potentially cumbersome. If you run a website that stores cookies in a person’s browser, collect email addresses for a newsletter, or run a discussion forum, compliance is mandatory. There’s no way to prevent EU citizens from accessing your site, so the only way to protect yourself fully is to comply with the standards.
-
The California Consumer Privacy Act (CCPA)
As of July 1, 2023, companies in California must allow customers to access and control their data. This law is similar to the GDPR in the EU as it applies to any organization that collects data from California residents. Additionally, it also extends to California-based businesses that handle personal information.
-
The Gramm-Leach-Bliley Act (GBLA)
All U.S. financial institutions that collect or store financial data must comply with the GBLA. This law applies to banks, credit unions, and other companies that provide financial advice, loans, and even insurance.
Under the GBLA, companies must provide consumers with a way to opt out of having their data shared with third parties. This opt-out preference will remain effective indefinitely until canceled in writing by the consumer. Privacy notices are required to be sent to customers. Organizations are also prohibited from sharing account numbers for marketing purposes.
-
PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) is one of the oldest and most well-known security standards, but some organizations are still not compliant. These standards apply to transactions, wireless hotspots, shopping apps, and transmitting credit card data to third-party providers.
The 12 basic PCI DSS requirements are:
- The use of strong passwords for modems, routers, POS systems, and any other tool that might be easily accessed.
- Card data must be encrypted with a specific algorithm. Primary account numbers must be scanned regularly to ensure there are no unencrypted account numbers.
- Software must be kept up to date with new releases, fixes, and patches to prevent vulnerabilities from being exploited.
- The use of antivirus software on all devices that access or store primary account numbers.
- Data must be encrypted while in transit and not just while at rest.
- The use of firewalls to prevent unauthorized access to data.
- Access to data must be restricted as much as possible on a need-to-know basis.
- Individual credentials must be used for data access.
- Restrict physical access to devices that hold data.
- Keep records, like access logs.
- Vulnerability testing to catch potential vulnerabilities on a regular basis.
- All devices, software, and equipment used must be documented, along with how and where information is stored. Additionally, the documentation should include details on how the information is used after each sale.
Compliance isn’t hard – it just takes some diligence
Generally speaking, compliance isn’t as hard as it may seem. For example, using strict end-to-end encryption for all sensitive data will make you compliant on many fronts. The key is to find out which laws your company is required to follow. Then consult with an expert to get into compliance. It’s worth the time, energy, and cost involved to beef up your cybersecurity game. The consequences of just one incident can be devastating.
Thank you for reading!