Compliance Requirements for Cyber Security

Various compliance regulations such as PCI DSS clearly articulate in their requirements about how to manage risks, whether that includes an internal process or involvement of third-party service providers, merchants etc. For example, PCI DSS 3.0 includes requirements like penetration testing, application development lifecycle security, and threat modelling – all facts to the point that supply chain risks are an escalating concern. PCI DSS 3.0 requirements indicate that a downstream software supply chain is an emerging attack vector.

It is especially important for organizations to understand that to cover cyber risks, organizations not only need to assess everything in their internal environment but also for all the actors involved in the supply chain. For example, credit card organizations which are compliant with PCI DSS need to assess risks with merchants, distributors, credit card makers, banks, service providers – i.e., all the actors involved in the complete supply chain.

VEvolve helps to evaluate the customer environments and asset against the requirements mentioned at the standards.

1. ISO 27001

This is one of the common standards that adhere to the organization to implement an Information security management system. It is comprised of the set of procedures that states the rules and requirements which must be satisfied to get the organization certified with this standard. As per this standard, the organization is supposed to keep all the technology up to date, the servers should exist without vulnerabilities and the organization must be audited after the specified interval to remain compiled to this standard. It is an international standard and every organization that serves other organization that complies with this standard is supposed to comply with ISMS policy that is covered under ISO 27001 practice.

2. PCI DSS

PCI DSS stands for Payment Card Industry Data Security Standard. This can be considered as the standard that has to be opted by the organization that accepts payment through their gateway. The businesses that store user data like their name and card related information must have to adopt this standard in their organization. As per this compliance, the technologies used by the organization should be up-to-date and their system should continuously undergo the security assessment to ensure that it is not having any severe vulnerability. This standard was developed by the cluster of card brands (American Express, Visa, MasterCard, JCB, and Discover).

3. HIPAA

HIPAA stands for Health Insurance Portability and Accountability Act. It is the standard that the hospitals are supposed to follow to ensure that their patient’s data are fully protected and cannot be leaked anyway. In order to comply with this standard, the hospital must have a strong network security team who takes care of all the security incidents, their quarterly security reports should be healthy, all the transaction has to be done in encrypted mode and so on. This standard ensures that the critical health-related information of the patient will remain secure so that the patient can feel safe about their health.

4. FINRA

FINRA stands for Financial Industry Regulatory Authority. This standard is all about making things secure for the financial bodies that handle the funds or aggressively engaged in financial transactions. In this standard, the system is supposed to be highly secure and to comply with this standard, various measures must be considered in terms of data security and the user’s data protection. It is one of the most essential standards that all the organizations based on finance are supposed to comply with.

5. GDPR

GDPR stands for General Data Protection Regulation. It is a standard defined by the European government which is concerned about the data protection of all the users. In this standard, the body that must manage the compliance has to make sure that the user’s data is secure and cannot be accessed without proper authorization. As the name states, this standard mainly focuses on the safety of the user’s data so that they can feel safe while sharing it with any of the organizations that are complying with the General Data Protection Regulation.

6. NIST Framework

The Framework provides a common language for understanding, managing, and expressing cybersecurity risk both internally and externally. It can be used to help identify and prioritize actions for reducing cybersecurity risk, and it is a tool for aligning policy, business, and technological approaches to managing that risk. It can be used to manage cybersecurity risk across entire organizations, or it can be focused on the delivery of critical services within an organization. Different types of entities – including sector coordinating structures, associations, and organizations – can use the Framework for different purposes, including the creation of common Profiles.

The key steps are,

• Identify

• Protect

• Detect

• Respond