When Compliance isn’t Good Enough: Thinking Beyond Regulations is a Must

With the January 2020 deadline for CCPA compliance looming, what lessons from GDPR compliance apply most this time around? Topping the list should be thinking and acting beyond compliance to build and sustain a long-range view of data security.

Achieving compliance should be seen as passing a milestone, not crossing the finish line.

‘Compliance is a seat belt on a 747’

In a recent presentation, Dr. Chase Cunningham, principal analyst at Forrester serving security and risk professionals, says, “Compliance is a seatbelt on a 747. You’ve got to have it to back away from the gate; it’ll probably help you if you hit some turbulence on the way. However, if things go really bad, does anyone really think a three-inch strip of nylon is going to make you walk away from a plane crash? Absolutely not. Compliance is not a strategy.”1

Dr. Cunningham is absolutely right. Compliance is an important checkmark, but not a strategic lever for driving an effective data protection strategy. Focusing on short-term compliance goals and settling for checkmark solutions might suffice initially but will fall short in the long run.

No one wants to realize a year later that the decision wasn’t part of a holistic strategy. This narrow-minded thinking can set you back by opening the door to unforeseen vulnerabilities.

Start with a Data Protection Mindset

Compliance should be a byproduct of an overarching security strategy, with greater focus on data protection as the pivotal point of entry. Think of compliance as the “what.” As in what is driving short-term action? Then, quickly move to the “why.” Why do I want to be compliant? The answer should always be “to protect my data.”

While compliance can provide useful guardrails, it doesn’t go as far or wide in delivering all the necessary protection, especially in terms of personal data privacy.

Do the Right Thing: Respecting Personal Data Privacy

After watching Mark Zuckerberg get raked over the coals before Congress recently, it’s easy to see that privacy is—and should be—on everybody’s mind. Companies of all sizes across every industry must focus on doing the right thing—for their business, customers and employees—by tackling the pervasive personal data privacy problem.

Finding all the places personal data exists is tricky as it proliferates across emails and files as soon as they’re created. That’s why it’s wise to gain a thorough understanding of the current data environment and impact of personal data on the existing security architecture.

It will take time to gauge how much personal data is created on a daily basis. So, iterative steps, and even a handful of tools are recommended to assess personal data risk exposure accurately.

Mindset Drives Methodology

Proper data security requires risk assessment and abatement as an ongoing evolution characterized by persistence and patience. Look for tools that deliver incremental value. Diligence is necessary for revisiting risk profiles and identifying security gaps.

Be mindful of cultural implications and upfront in communications about the importance of having a shared security responsibility. It’s not about putting burden on employees to ensure privacy is a front-and-center issue. It’s more about providing a methodology that reduces risk without making it more difficult for employees to do their jobs.

Look for solutions that automate and simplify the process to facilitate more widespread acceptance. Whether motivated by doing right by employees and customers or avoiding significant fines—remember, achieving compliance simply isn’t good enough. What’s most important is ensuring proper protection policies bolster data privacy while putting the organization on a strategic security path.

1. Dr. Chase Cunningham, SecurIT Summit 2018

About the Author

Mark Cassetta, senior vice president of strategy for Titus, oversees the product lifecycle from concept to implementation and customer success.

Featured

New Products

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure.

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.