Given all of the recent corporate scandals and security breaches, the government is cracking down on all businesses – holding them more accountable for the security of their sensitive information like credit card data and personal health records. Since many businesses accept credit cards as a form of payment, almost every business is subject to PCI compliance.
Here is a high level view of some of the government regulations that might affect your small business and some suggestions on how to achieve information technology compliance (I specify information technology compliance because you may have to do other things from a human resources or business process perspective that this article does not address.)
Disclaimer: I’m not lawyer and am providing you this information to the best of my knowledge. If you have concerns, seek out an attorney, compliance consultant relative to the the regulation(s) you are concerned with, an IT consultant or any combination of the above.
You can find more information about these regulations and others at http://www.compliancehome.com/
Payment Card Industry Data Security Standard (PCI DSS or commonly called just “PCI”)
PCI is a set of comprehensive requirements for enhancing payment account data security and was developed by the founding payment brands of the PCI Security Standards Council, including American Express, Discover Financial Services, JCB, MasterCard Worldwide and Visa International. Credit card companies and acquirer banks can levy stiff fines and remove the merchant’s ability to process credit card transactions until the merchant is PCI compliant.
Health Insurance Portability & Accountability Act of 1996 (HIPAA)
HIPPA requires that to ensure privacy and confidentiality, all patient healthcare information be protected when electronically stored, maintained, or transmitted. It also mandates that each user be uniquely identified before being granted access to confidential information. It specifies that access to personal health information (PHI) be restricted to only those individuals who need access as part of their role.
Gramm-Leach-Bliley Act (GLBA)
GLBA mandates privacy and the protection of customer records maintained by financial institutions. These security requirements include access controls on customer information systems, encryption of electronic customer information, procedures to ensure that system modifications do not affect security, and monitoring systems to detect actual attacks or intrusions.
Sarbanes-Oxley Act of 2002
This Act came about as a result of the large corporate financial scandals involving Enron, WorldCom, Global Crossing and Arthur Anderson. Effective as of 2006, this Act only affects publicly traded companies. However, being “SOX-like” is a good idea if your goal is to be acquired by a large publicly traded company.
Technology Required for Compliance:
In the case of PCI, HIPAA and GLBA “encryption” and “archival” are the two words you will run into the most and likely to cost you the most money because it will require additional purchases in technology solutions.
Encryption
Encryption simply means “To conceal information by means of a code or cipher” so that only authorized people can access and use the information. In the case of PCI, HIPAA and GLBA, and, as it relates to information technology, files (information) and email (communication) must be encrypted.
To encrypt disks and files you can use Windows Server 2008 using the built in Encrypting File System feature or, for R2 users of Windows 2008 server, Bitlocker is available. which is what you would use on Windows 7 Enterprise or Ultimate desktops and laptops as well.
Email encryption would need to be done through a third party provider such as Carceron.
Email Archival
HIPAA and GLBA also require email archival. Even though recent versions of Microsoft Exchange come with some limited archiving ability, it’s not sufficient from a compliance perspective. You will need a third party company that can capture all ingoing and outgoing correspondence in an off-site archive where messages cannot be deleted. This is especially important for any financial businesses regulated by SEC through GLBA.
Access Control & Auditing
All of the above regulations have requirements regarding access control to files, email etc. as well as auditing requirements. Auditing in this case translates to “logs of who access what and when”. All of the current Windows systems (both server and desktop based) have these features built in – they simply need to be configured by an IT consultant. Another means of preventing access to sensitive information is 2-factor authentication.
