Regulatory Compliance Solutions: The Security Maturity Journey

Summary

• Achieving regulatory compliance is simplified when you understand the complexities and pitfalls
• Cybersecurity products and services each play a specific role in furthering compliance efforts
• Employees correctly following protocols will make or break your security compliance program
• Secureworks® can help you plot a course forward to move along the security maturity continuum

Regulatory compliance—conforming to specifications, policies, standards, laws, and rules, often with civil or criminal penalties—is mandatory for many industries, especially those in finance, healthcare, and government. However, Wikipedia’s regulatory compliance page states, “The definition of what constitutes an effective compliance plan has been elusive.” We couldn’t disagree more and urge the adoption of an updated definition that makes compliance achievable with a properly informed strategy.

Many information security companies offer regulatory compliance solutions. A “solution” suggests an effective compliance plan plus an effective implementation; however, many offerings consist of disjointed software or services. Properly configuring software and infrastructure to achieve regulatory compliance takes expertise. Staff must also follow specific protocols to facilitate the necessary evidence collection and demonstrate compliance.

Regulatory Compliance Software

Industry-specific and cross-industry regulatory compliance software can provide a general framework for organizations to follow. However, as cloud computing and big data continue to dominate organizational data management, we see more information security compliance software hit the market focused on managing regulated data. These solutions range from simple to robust. Most provide compliance audit trails. Some manage password usage and user access. Other regulatory compliance software tracks files throughout a network to classify, tag, and ensure appropriate use based on who is accessing them.

Where Compliance Software as a Solution Falls Short

Software only works where it is applied correctly and where fallible human beings follow protocols correctly. Large companies often operate in silos and lack a coordinated, enterprise-wide view of regulatory compliance risks. With many access points to big data, the mere absence of one dedicated local compliance resource creates significant risk for the entire company. IT security compliance software can add a layer of cybersecurity protection, but still leave gaps where there is lack of awareness and adherence to protocols.

Where Regulatory Compliance Services Fill Gaps

The biggest challenge with regulatory compliance is that with so many rules—and in this era of continuous staff turnover—people within the organization inevitably do not know all the rules and protocols they must follow. A compliance service uses experienced security professionals to determine what compliance software and infrastructure are needed, how to properly set them up, the processes to follow, and training as needed.

Getting your entire organization up to compliance standards—national, industry specific, or global—generally requires some initial compliance services that fall under security risk consulting. Once compliance has been met, you may desire ongoing regulatory compliance management or periodic assessments and gap analyses.

Regulatory Compliance for United States

• NIST Compliance – General Cybersecurity Best Practices and Government Compliance
  Presidential Executive Order (EO) 13636, Improving Critical Infrastructure Cybersecurity (Feb 2013), mandated NIST work with stakeholders to develop a voluntary framework based on existing standards, guidelines, and practices for reducing cyber risks to critical infrastructure. NIST’s cyber standards-setting role was further reinforced by the Cybersecurity Enhancement Act of 2014.

  The voluntary NIST-CSF Framework was created via an industry-government collaboration and consists of cybersecurity standards, guidelines, and practices to promote the protection of critical infrastructure. The Framework provides a flexible, repeatable, and cost-effective approach that helps owners and operators of critical infrastructure identify and prioritize their cyber risk.

  NIST Special Publication 800-171 combines security requirements of FIPS 200 for Federal Information Systems and NIST SP 800-53 Security and Privacy Controls for businesses into 110 discrete security controls across 14 administrative and technical categories, each with specific compliance requirements.

  Secureworks offers a comprehensive portfolio of cybersecurity products and services designed to help organizations further their NIST compliance objectives, with a Solution Brief to help you get started.

• Security Exchange Commission OCIE Cybersecurity Initiative and Exam
  The U.S. Security Exchange Commission Division of Examinations (formerly OCIE) announced a Cybersecurity Examination Initiative (PDF) that the Division will examine, at random, the cybersecurity practices of more than 50 regulated investment management firms to evaluate how they protect their firms and investors from cybersecurity threats in five specific areas . The exam helps regulators and industry partners gain an understanding of any areas where the SEC and the investment management industry can collaborate to help ensure overall protection from cyber threats, intrusions, and breaches.

  Secureworks has a deep understanding of the United States SEC Division of Examinations and helps investment firms build a strong security program, meet Division requirements, and prepare for exams.

• GLBA / FFIEC Compliance – IT Security for Financial Institutions (Banks and Credit Unions)
  GLBA and FFIEC are the main sources of financial compliance regulations. Established by the Gramm-Leach-Bliley Act (GLBA) of 1999, all Financial Institutions in the United States must create an information security program that secures customer financial information, protects the information from security threats, and denies any unwarranted access to the information. Federal Financial Institutions Examination Council (FFIEC) augments GLBA with a set of extensive and evolving compliance guidelines.

  Secureworks regulatory compliance services assist organizations through the complex regulatory process and provide audits and detailed explanations to help meet compliance needs and avoid high penalties.

• HIPAA Compliance – Healthcare Network Security Solutions
  HIPAA has become a popular information security standard adopted by businesses of all sizes to meet a basic, well-known level of cybersecurity. However, the Health Insurance Portability and Accountability Act (HIPAA) was originally created to simplify administrative processes and protect the Personal Identifiable Information (PII) of healthcare organizations. Specific information security standards set by HIPAA require policies and procedures to safeguard PII to meet compliance requirements.

  Secureworks has many years of experience in assisting healthcare organizations with their compliance requirements and can create a specialized information security package to meet your specific needs.

• PCI Compliance – Retail, Finance & Insurance Payment Card Industry Compliance Solutions
  If you handle any form of payment card data (i.e., credit, debit cards), you are required to meet Payment Card Industry (PCI) Compliance regulations throughout the year and to prove PCI requirements have been met for the entire year. These are sometimes referred to PCI DSS (PCI Data Security Standards) requirements. All organizations are required to protect the privacy and confidentiality of the payment card data and must have defined and implemented specific policies and procedures to do so.

  Secureworks provides several PCI regulations solutions for all industries with services to manage PCI compliance or meet PCI compliance, such as PCI Readiness Assessment, PCI Gap Analysis, PCI Mock Audits, and assistance with PCI SAQ (Self-Assessment Questionnaire). For organizations with large transaction volumes, Secureworks can conduct your PCI Report on Compliance (PCI ROC) as a PCI Qualified Security Assessor (QSA). See our comprehensive PCI Compliance Solution Brief to get started.




• NERC-CIP Compliance – Utilities and Energy Industry Cyber Security Solutions
  The North American Electric Reliability Corporation (NERC) maintains comprehensive reliability standards that define requirements for planning and operating the collective bulk power system and include Critical Infrastructure Protection (CIP) that ensures information security of the bulk electric systems in the US.

  Secureworks Managed Security Services align with NERC CIP compliance requirements and can even exceed industry standards for utility providers.

• EI3PA Compliance – Experian Independent Third-Party Assessment for Resellers
  Organizations that transmit, store, process, or provide consumer credit information from Experian are required to meet EI3PA Compliance guidelines and are subject to regulatory compliance audits by a third-party Qualified Security Assessor (QSA).

  As a PCI QSA and Approved Scanning Vendor (ASV), Secureworks can assist organizations with meeting EI3PA Compliance requirements and help avoid any penalties stemming from noncompliance.

• ISO 27001 / 27002 Certification for ISMS
  Considered global regulatory compliance, ISO 27001 / 27002 represent the International Code of Practice for Information Security Management Systems (ISMS) and define specific standards to meet certification. Organizations certified to these standards have demonstrated that their ISMS are recognized globally to be following best practice procedures.

  Secureworks offers Security Controls Assessments to assist organizations with becoming ISO certified.

• FISMA Compliance – Information Security Services for Federal Agencies and their Affiliates
  The Federal Information Security Management Act of 2002 was developed to protect government information, operations, and assets from security threats. Each agency is responsible for ensuring their information security within the federal government and the Act requires annual compliance reviews.

  Secureworks provides numerous Managed Security Services for completing annual compliance reviews.

Global Regulatory Compliance

Aside from ISO 27001 and 27002, the most common regulatory compliance requirement worldwide is for General Data Protection Regulation (GDPR) and PCI regulations. Secureworks specializes in GDPR and PCI compliance for the United Kingdom with offices in Edinburgh and London. Secureworks in Sydney provides GDPR and PCI compliance for Australia and are fully versed in current and upcoming data breach legislation. Secureworks also has regional offices that specialize in GDPR and PCI compliance for Germany, France, and Japan–plus a full suite of managed security services.

originally published onhttps://www.secureworks.com/blog/regulatory-compliance