This post first appeared on Risk Management Magazine. Read the original article.
In recent years, we have seen an increase in data privacy
laws around the world. In the United States, the California Consumer Privacy
Act (CCPA) went into effect this year, joining similar data privacy regulations
in Maine and Nevada. Five states have also implemented privacy task forces, and
many other state legislatures are considering consumer privacy laws.
As new privacy regulations are introduced, organizations
that conduct business and have employees in different states and countries are
subject to an increasing number of privacy laws, making the task of maintaining
compliance more complex. While these laws require organizations to administer
reasonable security implementations, they do not outline what specific actions
should be taken to satisfy this requirement. As a result, many risk managers
are turning to proven security frameworks that specifically address privacy.
Doing so can help organizations build privacy and security programs that make
compliance more manageable, even when beholden to multiple regulations.
Understanding Privacy and Security Frameworks
While no two frameworks are the same, each is designed to
help organizations identify and address potential security gaps that could
negatively impact data privacy. Such frameworks include the Center for Internet
Security (CIS) Top 20, Health Information Trust Alliance Common Security
Framework (HITRUST CSF), and the National Institute of Standards and Technology
(NIST) Framework.
CIS Top 20 features defensive security actions that serve as
a reliable starting point to reduce the probability of data breaches, organized
into three sections:
- Basic Controls include inventory of software and hardware assets, continuous vulnerability management, and controlled use of administrative privileges.
- Foundational Controls are more wide-ranging and detailed actions that fortify an organization’s defense, such as email protections, boundary defense, data protection and wireless access control.
- Organizational Controls deal more directly with actions businesses should take to create a culture of security, including employee training, incident response and management, and penetration tests/red team exercises.
California’s attorney general has called the CIS Top 20 an
example of “reasonable” security practices, though it is unclear if using this
framework as a program baseline will be considered defensible. Still,
industry-wide, it is considered the minimum level of security that
organizations collecting information should implement.
Originally designed for health care organizations and
third-party vendors that serve health care clients, HITRUST CSF leads
organizations beyond baseline security practices to establish a strong, mature
security program. Recently, HITRUST has expanded its relevancy and
applicability beyond health care to provide organizations in any industry with
a comprehensive and efficient approach to regulatory compliance and risk
management.
HITRUST incorporates input from data protection professionals
and existing regulations and standards into a single overarching security and
privacy framework. Taking both risk and compliance concerns into account,
HITRUST CSF is suitable for organizations of varying sizes and industries,
regardless of risk profile.
Before pursuing HITRUST certification, organizations should
identify key stakeholders and define the scope. HITRUST recommends a
self-assessment to determine what areas should be addressed prior to a
validated assessment for certification. Based on the results of the readiness
assessment, the organization should develop a remediation plan for any issues
identified and work with its external assessor to define timing of the
validated assessment.
The NIST Framework also helps organizations move beyond baseline
controls to build a stronger security posture. It is composed of three parts:
- The Framework Core is a set of activities that helps an organization achieve certain cybersecurity outcomes and provides guidance to do so. Within the Framework Core are five functions to organize cybersecurity activities at their highest levels: identify, protect, detect, respond and recover.
- Framework Implementation Tiers are four categories of cybersecurity maturity:
- Tier 1: Partial. Risk management practices are not formalized, and there is little awareness of cybersecurity risk.
- Tier 2: Risk Informed. Some cybersecurity practices are in place, but may not be implemented in a consistent manner across the organization.
- Tier 3: Repeatable. A formalized, consistent, and enforced cybersecurity policy exists across the organization.
- Tier 4: Adaptive. An organization has a formalized cybersecurity policy and is continuously adapting it based on past experiences and trends that may alter the way it protects data. While organizations should strive to advance their level of cybersecurity maturity, it may not always be possible or necessary to do so, as tiers are based on an organization’s risk tolerance and other business needs.
- The Framework Profile aligns functions from the Framework Core and categories and subcategories within those functions with an organization’s business requirements, risk tolerance and resources to determine the current or desired state of cybersecurity activities. This profile can help set the stage for creating a plan to improve overall security posture.
Implementing any of these frameworks will better position an
organization for compliance with the security components of privacy
regulations, but always remember that it is not a one-time activity. Security
frameworks are regularly adjusted to reflect changes to existing laws,
introduction of new laws and the evolution of threats. Organizations should
regularly reassess their methods for addressing data privacy and security
against updated frameworks, determine how changes impact the risk of
noncompliance, and adjust their strategies accordingly.
With a number of consumer data privacy laws in effect and
more being proposed, businesses must take aggressive, proactive measures to
achieve compliance and prepare for enforcement. The absence of definitive
guidance from these laws will not preclude liability. Following the
prescriptive measures outlined in proven security frameworks will ensure
organizations not only meet industry-accepted standards, but also achieve
comprehensive security maturity that will yield benefits far beyond compliance.