The European Union’s (EU) General Data Protection Regulation (GDPR) enumerated individuals’ data privacy and protection rights, established regulations for organizations to comply with, and introduced sweeping operational changes. Any US-based organization that interacts with or processes data belonging to citizens of EU member states must comply with the GDPR. (more…)
Category: Compliance Standards
Staying informed about all of the cyber security compliance standards is essential to keeping your company safe from hackers. Read on to learn about the various steps you can take to stay up to date with your industry’s compliance standards.
-
Who Enforces CCPA Compliance?
The California Consumer Privacy Act (CCPA) took effect on July 1, 2020, providing state residents with the most comprehensive data privacy protections in the US. Comparable to the EU’s GDPR, the CCPA specifies individuals’ rights regarding companies collecting, using, and storing their personal data. (more…)
-
What Are the PCI Merchant Level Requirements?
Companies that process credit card payments must comply with the Payment Card Industry (PCI) Data Security Standard (DSS). Two essential questions for all organizations seeking PCI compliance are what is merchant PCI compliance? and what does it require? Below, we answer these and other questions about PCI merchant level requirements applicable to your business. (more…)
-
What is the HITRUST Threat Catalogue?
Organizations in any industry can benefit from threat intelligence, or information that helps identify, analyze, categorize, and ultimately mitigate cybersecurity threats. The HITRUST threat catalogue, a publication of the HITRUST Alliance, is designed with these aims in mind. It breaks down the most common and dangerous kinds of threats into manageable categories, so that an organization can swiftly determine how to address a given threat before it becomes a full event. (more…)
-
Can You Dispute Fines for PCI Non-Compliance?
Compliance with the Payment Card Industry Data Security Standards (PCI DSS) is critical to securing credit and debit card payment transactions. Organizations in the PCI industry deemed non-compliant with PCI DSS requirements may be subject to steep fines, ranging anywhere from $5,000 to $50,000 monthly, depending on the length of violation and compliance level. However, you can dispute fines for PCI non-compliance. (more…)
-
Changes Between HITRUST CSF v9.4 and v9.5
The HITRUST Common Security Framework, or HITRUST CSF, is a global, certifiable framework developed to aid organizations’ regulatory compliance efforts. In 2020, HITRUST CSF v9. 4 introduced several updates specific to the Cybersecurity Maturity Model Certification (CMMC) for US Department of Defense contractors. In September 2021, HITRUST v9. 4 was updated to v9. 5. What are the most significant changes in this latest version? (more…)
-
HITRUST Corrective Action Plan Management Strategies
The HITRUST Approach covers four key strategies to achieve your information security risk management and compliance goals: “Identify & Define,” “Specify,” “Implement & Manage,” and “Assess & Report.” Corrective action plans (CAPs) are categorized under Assess and Report. CAP management allows you to synthesize your collection of self-assessments, gaps in compliance, and other CAP data into a reliable, manageable, and distributable format that’s flexible for your organization’s security needs. (more…)
-
Top Security Monitoring Solutions for SOC 2 Compliance
Service organizations vary widely in nature, but all need to assure their clients’ trust. One significant hurdle to that effect is securing the networks upon which you and your customers rely. A SOC 2 audit, using the American Institute of Certified Public Accounts (AICPA) Trust Services Criteria (TSC), goes a long way toward earning that trust. Implementing network security monitoring solutions and techniques help ensure a successful SOC 2 audit report and optimize your cyberdefenses more broadly. (more…)
-
The HITRUST Cybersecurity Framework Assessment Methodology
One of the most comprehensive cybersecurity frameworks companies can implement is the HITRUST Alliance’s CSF. Full certification has many benefits, including streamlined compliance across other regulations and optimal security. Conducting a HITRUST Readiness Assessment, internally or with professional help, is one of the best ways to prepare for full implementation. (more…)
-
A Comprehensive Guide to PCI DSS Audit Procedures
Compliance with the Payment Card Industry’s (PCI) Data Security Standards (DSS) requires annual reporting. This annual compliance reporting involves extensive PCI DSS audit procedures for organizations that handle the highest transaction volumes. The audit procedures are conducted during the completion of an on-site assessment known as a Report on Compliance (ROC). (more…)