Any organization that handles cardholder data (CHD) is required to follow the Data Security Standards (DSS) established by the Payment Card Industry (PCI). These rules and regulations play a critical role in protecting networks and CHD environments (CDE) from internal and external threats alike. However, their effectiveness can depend on your staff following a few PCI DSS best practices. (more…)
Category: Compliance Standards
Staying informed about all of the cyber security compliance standards is essential to keeping your company safe from hackers. Read on to learn about the various steps you can take to stay up to date with your industry’s compliance standards.
-
How and Why DoD Contractors Must Protect Covered Defense Information
The federal government utilizes contractors to provide routine services and products to achieve the nation’s missions and conduct operations. During the course of business, the government shares sensitive information with federal contractors, which is then stored, processed, and transmitted via information systems. Department of Defense (DoD) contractors must abide by Defense Federal Acquisition Regulation Supplement (DFARS) requirements for protecting Covered Defense Information (CDI), which is directly related to national security. (more…)
-
How Non-Disclosure Agreement Risks Factor into EU GDPR Compliance
The European Union’s (EU) General Data Protection Regulation (GDPR) enumerated individuals’ data privacy and protection rights, established regulations for organizations to comply with, and introduced sweeping operational changes. Any US-based organization that interacts with or processes data belonging to citizens of EU member states must comply with the GDPR. (more…)
-
Who Enforces CCPA Compliance?
The California Consumer Privacy Act (CCPA) took effect on July 1, 2020, providing state residents with the most comprehensive data privacy protections in the US. Comparable to the EU’s GDPR, the CCPA specifies individuals’ rights regarding companies collecting, using, and storing their personal data. (more…)
-
What Are the PCI Merchant Level Requirements?
Companies that process credit card payments must comply with the Payment Card Industry (PCI) Data Security Standard (DSS). Two essential questions for all organizations seeking PCI compliance are what is merchant PCI compliance? and what does it require? Below, we answer these and other questions about PCI merchant level requirements applicable to your business. (more…)
-
What is the HITRUST Threat Catalogue?
Organizations in any industry can benefit from threat intelligence, or information that helps identify, analyze, categorize, and ultimately mitigate cybersecurity threats. The HITRUST threat catalogue, a publication of the HITRUST Alliance, is designed with these aims in mind. It breaks down the most common and dangerous kinds of threats into manageable categories, so that an organization can swiftly determine how to address a given threat before it becomes a full event. (more…)
-
PCI Compliance Network Security Requirements
It is critical for payment card industry (PCI) organizations to protect cardholder data (CHD) integrity throughout processing, storage, and transmission. Specifically, PCI compliance network security can help minimize the risks of CHD breaches during processing and transmission across web applications and networks. Recent data breaches highlight the need for PCI organizations to address the exploitable network security vulnerabilities that could potentially compromise CHD integrity. Read on to learn more about how to address these vulnerabilities via PCI compliance network requirements. (more…)
-
Can You Dispute Fines for PCI Non-Compliance?
Compliance with the Payment Card Industry Data Security Standards (PCI DSS) is critical to securing credit and debit card payment transactions. Organizations in the PCI industry deemed non-compliant with PCI DSS requirements may be subject to steep fines, ranging anywhere from $5,000 to $50,000 monthly, depending on the length of violation and compliance level. However, you can dispute fines for PCI non-compliance. (more…)
-
Changes Between HITRUST CSF v9.4 and v9.5
The HITRUST Common Security Framework, or HITRUST CSF, is a global, certifiable framework developed to aid organizations’ regulatory compliance efforts. In 2020, HITRUST CSF v9. 4 introduced several updates specific to the Cybersecurity Maturity Model Certification (CMMC) for US Department of Defense contractors. In September 2021, HITRUST v9. 4 was updated to v9. 5. What are the most significant changes in this latest version? (more…)
-
HITRUST Corrective Action Plan Management Strategies
The HITRUST Approach covers four key strategies to achieve your information security risk management and compliance goals: “Identify & Define,” “Specify,” “Implement & Manage,” and “Assess & Report.” Corrective action plans (CAPs) are categorized under Assess and Report. CAP management allows you to synthesize your collection of self-assessments, gaps in compliance, and other CAP data into a reliable, manageable, and distributable format that’s flexible for your organization’s security needs. (more…)