For some industries, compliance is not only clear, but
clearly defined. Most people know what HIPAA is even if they don't work in the
medical industry, and changes to CMMC or FTC guidelines will occasionally show
up in news cycles.
The flashy ones (usually the ones with the greatest
penalties) are not the only frameworks to consider though, and even if you know
one framework your business needs to adhere to, that may not be the only one.
For over 40 years, Santa Clarita businesses have been coming
to The Network Doctor for compliance support; our mission is about keeping
technology within guidelines but also understanding what those guidelines are
and how they're changing.
Nothing can replace the expertise of an IT service provider
working with a business one-on-one, but to get started, if you're not sure
which compliance framework your business needs to stick to, here's a starter.
FTC Safeguards Rule
What it is: the FTC Safeguards Rule applies to financial
institutions, requiring those institutions to have a process for keeping
customer information secure. This requirement extends to vendors and MSPs.
Who it applies to: any financial institution like accounting
firms, lenders, auto dealers, tax preparers and more.
Services offered: The Network Doctor provides risk
assessment services, a written security program, and qualified individual
support for financial firms needing to comply with this rule.
PCI-DSS
What it is: PCI-DSS (payment card data security standard)
compliance was built to encourage and enhance security for payment card
accounts. It reduces credit card fraud as businesses become more and more
card-dependent.
Who it applies to: any business that takes debit or credit
card payments for any reason, either in-person or over the phone/internet.
Services offered: scope reduction, SAQ support, and
quarterly control reviews are just a few of the PCI-DSS compliant services we
offer our clients.
CMMC
What it is: a multi-level, multi-step framework that is
often considered the most rigorous compliance framework for traditional
businesses. Compliance is serious and costly.
Who it applies to: all defense contractors and their
suppliers/vendors. The chain of CMMC compliance is very important to be
documented and understood; companies can miss out on contracts even when doing
everything right because they partner with a vendor who is not compliant.
Services offered: gap analysis, SSP and POA&M, control
implementation, and other rigorous security services.
HIPAA
What it is: a framework designed to protect personal
identifiable information (PII) from patients seeking healthcare so their
private medical information is not available.
Who it applies to: medical, dental and other healthcare
businesses.
Services offered: security risk analysis, policy building,
workforce training (the most important part of HIPAA compliance is keeping all
healthcare workers trained on it)
Cyber Insurance
What it is: cyber insurance is part of many other compliance
frameworks, it is an insurance policy that protects you in the event of a
cyberattack and requires a certain degree of cyber hygiene.
Who it applies to: any business renewing a policy, which
every business should have, so it applies to everyone.
Services offered: attestation evidence: MFA, EDR, backup and
patching
None of the services offered are exclusive to any one
compliance framework; The Network Doctor will happily do workforce training for
PCI compliance or a security analysis for the FTC Safeguards Rule as necessary.
Additionally, all compliance services are built on a
rock-solid, time-tested foundational control set including MFA, encryption,
EDR, logging, vendor review and more.
When you partner with a qualified MSP for compliance
services, it should be their responsibility to know what frameworks apply to
you and how to get you compliant with a quick, cost-efficient plan.
Realizing you could use some compliance support? Schedule
your FREE 15-Minute Discovery Call today with The Network Doctor for compliance
support and expertise that has been serving Santa Clarita for over four
decades.
