Regulatory compliance

Information is the new currency

More and more businesses exchange files that contain private or confidential information. High-profile incidents in which customer records, employee data and intellectual property were leaked, lost or stolen have led governments and industry bodies to adopt strict security and privacy rules. These rules require organizations to protect personal information and digital assets by encrypting and controlling data in motion and at rest. They include:

• Payment Card Industry Data Security Standard (PCI DSS). Requires any company that processes, stores or transmits payment card data to protect it, including account numbers, magnetic stripe data, CVV and PIN.
• Gramm-Leach-Bliley Act (GLBA). Requires U.S. financial institutions to protect clients' nonpublic personal information in transit and at rest.
• Health Insurance Portability and Accountability Act (HIPAA). Requires U.S. healthcare organizations to protect the confidentiality and integrity of patient information in transit and at rest.
• Sarbanes-Oxley (SOX). Section 404 requires U.S. public companies to maintain effective internal controls over financial reporting. In practice that often means strong authentication, plus encryption of sensitive files in transit to prevent unauthorized access and show the data wasn't changed.
• National Credit Union Administration (NCUA). Requires federally insured U.S. credit unions to run a security program that protects member records and information.
• Federal Financial Institutions Examination Council (FFIEC). Sets IT standards for financial institutions, including encrypting sensitive information sent over public networks.
• Family Educational Rights and Privacy Act (FERPA). Requires institutions that receive U.S. Department of Education funding to protect confidential student information.
• FDA 21 CFR Part 11. Applies to biotech and pharmaceutical firms, providers, hospitals, HMOs and pharmacies, which must protect patient data in transit and at rest.
• U.S. state breach disclosure laws. Modeled on California's S.B. 1386, these laws require businesses to notify people when their unencrypted personal information is exposed in a breach.
• PIPEDA (Canada). Requires personal information collected by companies to be protected with safeguards such as passwords and encryption.
• EU data protection rules. Require personal data collected by companies to be reasonably protected against loss, misuse and unauthorized access. Failing to encrypt sensitive data can be judged unreasonable.
• Personal Information Protection Act (Japan). Requires medical, financial, credit and telecom companies to keep personal data secure from loss and unauthorized disclosure.
• Personal Data (Privacy) Ordinance (Hong Kong). Requires all practicable steps to protect personal data, with particular regard to secure transmission.

The cost of compliance will grow with each new regulation, especially if IT builds a separate set of controls for each one. Many organizations want to meet several requirements with a single set of controls.

Gartner