Cybersecurity compliance isn’t easy. There are dozens of acronyms, hundreds of controls, and many small business owners find themselves completely overwhelmed. Compliance requirements vary and can be imposed by law, regulatory bodies, and even private industry groups such as the Payment Card Industry. In this Dark Cubed explainer, we will cover each major cybersecurity compliance requirement, explain what they entail, and provide practical advice on how you can begin working towards a culture of compliance.
Let’s start off with the basics.
What Does Cybersecurity Compliance Mean?
Cybersecurity Compliance involves meeting various controls (usually established by regulatory authorities, laws, or industry groups) to protect the confidentiality, integrity, and availability of data. Compliance requirements vary by industry and sector, but typically involve employing a range of specific organizational processes and technologies to safeguard data. Controls come from a variety of sources, including CIS, the NIST Cybersecurity Framework, and ISO 27001. To read more about Cybersecurity Frameworks, check out our comprehensive guide. If you’re interested in specific niches, it’s worth checking out our post on healthcare cybersecurity.
How do I start a Cybersecurity Compliance Program?
- IDENTIFY WHAT TYPE OF DATA YOU WORK WITH AND WHAT REQUIREMENTS MAY APPLY
To begin working towards compliance, it’s important to first determine which regulations or laws you need to follow. To start with, every state in the U.S. has data breach notification laws that require you to notify customers if their personal information is compromised. You can find the specific laws and requirements for your state here.
Compliance requirements vary vastly from state to state, and some apply regardless of whether your business is located in the state. For instance, the California Consumer Privacy Act and the NYDFS Cybersecurity Regulation impose requirements that can apply to your business in any state if you deal with data pertaining to these acts. If your business deals with the financial information of a resident of New York, for example, you would be subject to the set of requirements laid out by the NYDFS Cybersecurity Regulation regardless of which state your business is in.
Next, it’s important to determine what type of data you are storing and processing, as well as which states, territories, and countries you are operating in. In many regulations, specific types of personal information are subject to additional controls. PII stands for personally identifiable information, and includes any data that could uniquely identify an individual. Examples include:- Social Security Numbers
- First/Last Name
- Date of Birth
- Address
- Mother’s Maiden Name
- Medical Appointment Information
- Medical History
- Admissions Records
- Prescription Records
- Insurance Records
- APPOINT A CISO
The vast majority of company’s are far too small to justify hiring a six-figure CISO to manage cybersecurity and compliance for them. However, any employee with the right knowledge and work ethic can be appointed to manage cybersecurity as a part-time duty. By appointing an individual responsible for organizational cybersecurity and compliance, you can receive regular updates on the status of your cybersecurity program and compliance efforts. Furthermore, other employees know who to contact in the event of a suspected breach. Your CISO may want to consider consulting a cybersecurity company or attorney to determine which compliance requirements may apply to your company. Some roles that may be able to serve as a dual CISO:- Chief Technology Officer
- Chief Information Officer
- Chief Operating Officer
- IT Manager
- CONDUCT RISK AND VULNERABILITY ASSESSMENTS
Almost every major cybersecurity compliance requirement requires a risk assessment and vulnerability assessment. These are critical for determining your organization’s most critical security flaws, as well as the controls you already have in place. You can find a complete guide on how to conduct a comprehensive Risk Assessment here. You can also find templated risk and vulnerability assessments on our cybersecurity resources page. When conducting vulnerability assessments, it’s also worth carefully considering your risk from ransomware attacks. - IMPLEMENT TECHNICAL CONTROLS BASED ON REQUIREMENTS AND TOLERANCE
Your next step should be to implement technical controls based on your risk tolerance (as identified in the risk assessment) and the cybersecurity regulation you adhere to. Alternatively, you can use a cybersecurity framework as a guideline and then add technical controls to meet specific requirements. Here are some examples of technical controls:- Standardized Anti-Virus across all endpoints
- Implementing a Firewall
- Implementing Network Monitoring Software
- Implementing Log Aggregation Software
- Encrypting Sensitive Data
- IMPLEMENT POLICIES, PROCEDURES, AND PROCESS CONTROLS
Cybersecurity isn’t just about technology. Having policies and procedures in place to mitigate risk is also crucial for both compliance and safety. No technical safeguard in the world can stop an employee who is determined to download malware onto corporate computers or visit risky websites. Some examples of non-technical controls include:- Mandatory Employee Cybersecurity Training
- Fully documented policies and procedures (you can find templates here)
- Audit and Accountability Processes
- Appointing a CISO
- Conducting Risk and Vulnerability Assessments
- REVIEW AND TEST
Review the applicable requirements you need to meet and ensure you regularly test your controls. As businesses change and expand, it can be easy to let cybersecurity slip, but by conducting regular tests, you can make sure you stay compliant. It is wise to continually evaluate compliance as new requirements are introduced and existing ones change, and to conduct regular tests of both technical and process controls. If you are unsure about whether you are meeting a compliance requirement, we recommend you consult with an attorney specializing in cybersecurity compliance.
