The General Data Protection Regulation and GDPR Compliance Explained

The deadline for GDPR compliance is right around the corner; is your company ready? Here’s what you need to know about this important new data protection law and what your organization must do to prepare for it.

What is GDPR?

The General Data Protection Regulation, or GDPR, was adopted by the European Parliament in April 2016 as a replacement for an outdated data privacy directive that passed in the 1990s. The goal of the GDPR is to protect the personal data of EU citizens in the digital age. EU citizens will have numerous data privacy rights under the GDPR, including the right to prompt notification of a breach, the right to access their personal data, and the “right to be forgotten.”

What Constitutes “Personal Data” Under the GDPR?

Under the GDPR, “personal data” is a broad term encompassing “[a]ny information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person.” This covers everything from an individual’s name and street address to their physical address to their health or biometric information. Even social media posts are considered “personal data.”

Who Must Comply With GDPR?

Although the GDPR is technically a European regulation, in reality, it applies internationally. In addition to applying to all companies with a presence in the EU, any company that sells goods and services to individuals or companies located in the EU or that “monitor[s] the behaviour of EU data subjects” must comply with the GDPR, regardless of where the company is located.

This means that GDPR compliance applies to nearly all large businesses, as well as many small and medium-sized businesses; if you have even one customer located in the EU, you must comply.

When is the GDPR Compliance Deadline?

Organizations must comply with the GDPR by May 25, 2018.

How Will Brexit Impact GDPR Compliance? What If I Only Sell to UK Customers?

Companies that are located in the UK or that sell to UK customers should still prepare to comply with GDPR. The UK is not scheduled to leave the EU until March 29, 2019, 10 months after the GDPR compliance deadline. Further, the British government has stated that it intends to pass its own data protection bill that will be at least as stringent as the GDPR, if not more so.

What Constitutes GDPR Compliance?

At its core, the GDPR is about data governance. Organizations will need to change the way in which they process, store, and protect customers’ personal data, keeping in mind the various data privacy rights outlined in the GDPR. Similar to HIPAA, the GDPR does not outline specific technical controls but instead tells organizations what they need to achieve; it’s up to them to figure out how.

One of the biggest changes is the GDPR breach notification requirement; companies must notify the authorities and affected customers within 72 hours of detecting a breach. This requirement is meant to prevent scenarios like the Uber hack, where the company not only waited a year to notify its customers but actually tried to cover the incident up.

The GDPR also addresses the growing problem with third-party vendor breaches. Organizations that hire third-party vendors who will be handling the personal data of their EU customers will have to ensure that their contracts with those vendors comply with the GDPR.

Additionally, some organizations will have to appoint a Data Protection Officer (DPO) to oversee GDPR compliance and overall data security. This requirement applies to organizations that are public authorities, “engage in large scale systematic monitoring,” or “engage in large scale processing of sensitive personal data.”

What Are the Penalties for Non-Compliance?

Depending on the severity of the infraction, organizations can be fined up to 4% of their annual global turnover, or 20 million euros (approximately USD $24 million).

How Can I Get Ready for GDPR Compliance?

The best way to prepare for the GDPR is to enlist help from an experienced IT audit and compliance firm like the GRC experts at Lazarus Alliance. The full text of the GDPR is 88 pages long, and what “compliance” means for your organization depends on your individual data environment, cyber ecosystem, risks, and vulnerabilities. For example, the GDPR specifies that companies must provide “reasonable” levels of data privacy and protection to EU customers, but what is considered “reasonable” is left open for debate – and you don’t want to end up on the losing side of that one!

While many organizations are dreading GDPR compliance, in the end, it will be a net positive for everyone. The GDPR will force companies to closely examine their data governance policies and controls and enact proactive cyber security measures to prevent breaches.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

Ensure a secure cloud migration with these simple, proactive cyber security tips

Enterprises have much to gain by migrating to the cloud, which is why the U.S. government has adopted a “cloud-first” initiative. Cost savings and the ability to scale up and down quickly as organizational needs change are among the benefits of cloud computing. However, the cloud also presents its own set of security issues that can differ, sometimes fundamentally, from what organizations are used to dealing with in-house, and numerous high-profile breaches involving Amazon Web Services customers have left many companies spooked about migrating to the cloud. Fortunately, a secure cloud migration is entirely possible by following a few proactive cyber security practices.

Understand That Cloud Security Differs from On-Site Cyber Security

The first step to a secure cloud migration is to understand that cloud security must be addressed differently from your on-site cyber security. Among other things, you must understand where your cloud provider’s cyber security responsibilities end and yours begin. In general, your cloud provider is responsible for securing the actual cloud infrastructure, such as their physical data centers; your organization is responsible for securing your data and ensuring that you comply with all applicable standards, such as HIPAA and PCI DSS. For example, if your data is breached because one of your users changed the privacy settings of a cloud folder from “private” to “public,” your cloud provider cannot be held responsible.

Put Sound GRC at the Heart of Your Cloud Security

All of the Amazon Web Services breaches that have been in the news have one thing in common: They could have been prevented if the victimized companies had followed fundamental information governance, risk, and compliance (GRC) practices. Cloud security starts with a secure cloud migration plan, which must be rooted in sound GRC. Your organization must identify and clearly define which data is to be stored in the cloud (especially sensitive data probably shouldn’t be), how to set up the cloud hierarchy, and the level of access to grant each user and user group. For example, only certain high-level users should have the ability to change the access levels of cloud folders.

On a related note, migrating to the cloud means altering your entire data environment, which means that all of your cyber security and compliance processes must be reevaluated. A secure cloud migration will do you little good if one of your internal systems is breached.

Look for FedRAMP Certification

U.S. government agencies are required to choose cloud service providers that are FedRAMP-certified. However, it’s a good idea for private-sector companies to give preference to FedRAMP-certified providers as well, because FedRAMP is arguably the “gold standard” in cloud security, indicating that the provider has undergone a rigorous, comprehensive data security audit.

Seek Professional Help

From determining which data is to be stored in the cloud to properly configuring a cloud server, cloud migration can be tricky.  Most organizations do not have the in-house resources to perform a successful, secure cloud migration or ensure cloud security and compliance moving forward, especially in light of the cyber security skills shortage. The security of your systems and data is too important to cross your fingers and hope for the best. Enlist the help of a professional cyber security firm with expertise in GRC, cloud security, and in-house security from the very beginning.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

FISMA vs. FedRAMP and NIST: Making Sense of Government Compliance Standards

FISMA, FedRAMP, NIST, DFARS, CJIS, HIPAA … Government compliance standards can seem like a veritable alphabet soup. Making matters even worse, a lot of them overlap, and many organizations aren’t certain which standards they need to comply with.

Even if your organization does not currently operate in the public sector, it is important to understand the fundamentals of FISMA, FedRAMP, and NIST. First, the U.S. government is the single largest buyer of goods and services in the world, and your company may ultimately want to tap this lucrative market. Second, any information security standards that the federal government implements will ultimately trickle down into state and local laws, as well as industry frameworks.

What is NIST?

The National Institute of Standards and Technology (NIST) is a non-regulatory agency that is part of the United States Department of Commerce. Its mission is “To promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.”

Among many other responsibilities, NIST creates and promotes information security standards for the federal government. These standards are outlined in NIST’s SP-800 series of publications, including NIST SP 800-53 (also known as NIST 800-53), which outlines security controls for federal information systems and organizations and documents security controls for all federal information systems, except those designed for national security. Federal agencies must comply with NIST guidelines and standards within one year of their publication.

The controls outlined in NIST 800-53 are the basis for FISMA as well as FedRAMP, DFARS, CJIS, HIPAA, FedRAMP +, FedRAMP DoD IL 2, 4, 5, 6 and others.

What is FISMA?

FISMA was first enacted in 2002 as the Federal Information Security Management Act, then updated in 2014 to the Federal Information Security Modernization Act. FISMA applies to:

• All federal government agencies
• State agencies that administer federal programs, such as Medicare/Medicaid and student loans
• All private-sector firms that support federal programs, sell services to the federal government, or receive federal grant money

In a nutshell, FISMA requires the implementation of information security controls that utilize a risk-based approach. The primary framework for FISMA compliance is NIST 800-53. Organizations that demonstrate FISMA compliance are awarded an Authority to Operate (ATO) from the federal agency they are doing business with. This ATO applies only to that particular agency; if an organization has contracts with multiple federal agencies, they must obtain an ATO from each one. The logic behind this is that because every federal agency has different data security needs and vulnerabilities, different controls may apply. A FISMA assessment may be performed directly by the agency granting the ATO or a third-party security assessor.

What is FedRAMP?

The Federal Risk and Authorization Management Program (FedRAMP) was designed to support the federal government’s “cloud-first” initiative by making it easier for federal agencies to contract with cloud providers. Like FISMA, the controls outlined in FedRAMP are based on NIST 800-53.

Unlike FISMA, which requires organizations to seek an ATO from each individual federal agency, a FedRAMP ATO qualifies a cloud service provider to do business with any federal agency. Because FedRAMP ATO’s are more far-reaching, the certification process is far more rigorous. It must also be performed by a certified third-party assessment organization (3PAO) such as Lazarus Alliance. Finally, FedRAMP is more specific than FISMA. FISMA applies to information systems security in general, while FedRAMP applies only to cloud service providers and federal agencies that plan to use cloud service providers.

Since the FedRAMP certification process is so demanding, a FedRAMP ATO is beneficial even for cloud service providers that do not currently work with the federal government. Private-sector companies are aware of how difficult it is to comply with FedRAMP and recognize it as a gold standard of cloud security.

However, this is not to say the FISMA compliance process is “easy.” Organizations need to map the specific NIST 800-53 controls to the FISMA requirements of each agency they wish to do business with. There are hundreds of different controls, and figuring out which ones apply in each situation can be quite complex.

Complying with FedRAMP, FISMA, and NIST 800-53

Regardless of which compliance framework is right for your organization, it’s best to partner with a certified 3PAO such as Lazarus Alliance. Our FISMA and FedRAMP Cybervisors™ will provide your decision-makers with a clear picture of certification costs, timelines, and internal resource demands to facilitate an informed decision about pursuing FedRAMP or FISMA certification based on NIST 800-53.

Further, by leveraging Continuum GRC’s proprietary IT Audit Machine, a revolutionary GRC software package that utilizes pre-loaded, drag-and-drop modules, Lazarus Alliance takes the pain and high costs out of the FedRAMP and FISMA compliance process. Some of our clients have saved up to 1,000% over traditional FedRAMP assessment methods.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call +1 (888) 896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.