Compliance

In general, compliance is defined as following rules and meeting requirements. In cybersecurity, compliance means creating a program that establishes risk-based controls to protect the integrity, confidentiality, and accessibility of information stored, processed, or transferred.

​

However, cybersecurity compliance is not based in a stand-alone standard or regulation. Depending on the industry, different standards may overlap, which can create confusion and excess work for organizations using a checklist-based approach.

​

What types of data are subject to cybersecurity compliance? 

Cybersecurity and data protection laws and regulations focus on the protection of sensitive data, such as personally identifiable information (PII), protected health information (PHI), and financial information. Personally identifiable information includes any information that uniquely identifies an individual, such as: 

• First and last name

• Date of birth

• Social security number

• Address

• Mother’s maiden name

Protected health information includes information that could be used to identify an individual or details regarding their health history or treatments, such as: 

• Medical history

• Records of admissions

• Prescription records

• Information about medical appointments

• Insurance records

Financial data includes information about payment methods, credit card numbers, and other details that could be used to steal an individual’s identity or financial resources. Stolen credit card numbers, for instance, can be used to make unauthorized purchases. Sensitive financial data includes: 

• Social security numbers

• Credit card numbers

• Bank account numbers

• Debit card pin numbers

• Credit history and credit ratings

Other sensitive data that may be subject to state, regional, or industry regulations includes: 

• IP addresses

• Email addresses, usernames, and passwords

• Authenticators, including biometrics such as fingerprints, voice prints, and facial recognition data

• Marital status

• Race

• Religion

 

Benefits of cybersecurity compliance

Organizations subject to industry or regional cybersecurity regulations are required by law to meet compliance and take the prescribed actions following the discovery of a data breach. Companies found to be non-compliant may face stiff fines and penalties should they suffer a breach. Strict adherence to cybersecurity compliance requirements reduces the risk of a data breach and the associated response and recovery costs, as well as the less-quantifiable costs of a breach such as reputation damage, business interruption, and loss of business. 

​

Having robust cybersecurity compliance measures in place, on the other hand, enables you to protect your company’s reputation, maintain consumer trust, and build customer loyalty by ensuring that your customer’s sensitive information is safe and secure. Plus, with clear and consistent systems for managing, storing, and using sensitive data, your business will benefit from greater operational efficiency.