Compliance Impacts Every Industry
When it comes to business and corporate management, compliance means abiding by all legal laws and regulations regarding managing their business, their employees, and how they handle their customers. The idea of compliance is to ensure that businesses and corporations act responsibly.
INDUSTRIES
Government |
 |
The US government requires all companies that do business with the government to follow the Federal Information Security Modernization Act (FISMA) framework. FIMSA includes the National Institute of Standards and Technology (NIST) 800-53 guidelines and is the best practices framework. Some departments take it a step further and require their cyber security certifications.
Cybersecurity Maturity Model Certification (CMMC) and NIST 171 is the cyber security standard that applies to sensitive information obtained by all contractors who provide services to the Department of Defense (DOD). These requirements have been set up in the Defense Federal Acquisition Regulation Supplement (DFARS) and Procedures Guidance and Information.
The purpose of DFARS is to outline all cyber security standards that third-party contractors are required to meet and follow before they do business with the Department of Defense to keep sensitive defense information protected.
CMMC was introduced in January of 2020 to build on the NIST 800-171 self-assessment framework set up by previous DFARS requirements and will eventually replace this standard, becoming the new standard for protecting Controlled Unclassified Information (CUI). There are three levels of CMMC compliance, defined by the types of CUI stored and transmitted by the organization. A company may be responsible for an audit or granular self-assessment dependent on their CMMC level and client requirements.
These federally mandated guidelines require companies to:
- Undergo a 110 control assessment
- Prepare a System Security Plan (SSP)
- Prepare a Plan Of Action and Milestones (POAM)
- Report their scores, prepare for potential audits
- Ensure that subcontractors and other organizations in the supply chain are also compliant.
Choice CyberSecurity is the partner you need to navigate your compliance requirement. We manage the controls, SSP, POAM, and the potential audit as a certified RPO Choice.
Healthcare |
 |
Perhaps the best-known cyber security compliance standard is the Health Insurance Portability and Accountability Act (HIPAA). HIPAA establishes the cyber security standards and best practices for all healthcare organizations, insurers, and third-party service providers. This requires all Covered Entities (CE) and Business Associates (BA) to meet all safeguards; administrative, physical and technical.
HIPAA provides a structure for protection for all Electronic Protected Health Information (ePHI) and Personal Identifiable Information (PII) provided by patients to their medical providers, digitally and in all other forms. HIPAA is federal compliance enforced by the HHS’s Office for Civil Rights.
HIPAA requires all CE’s and BAs to meet 85 controls and perform an annual risk assessment to meet and maintain HIPAA compliance. Our team of experts can guide you through the process of getting and staying HIPAA compliant.
Technology |
 |
With the increased use of digital and cloud-based data business transformation, organizations operating in the high-tech sectors will face a diverse and evolving threat landscape, making cyber security more important than ever.
Businesses want technology companies that demonstrate a mature cybersecurity posture as part of their supply chain, proving a compliance culture and assurance they are safe to engage them.
Tech companies can implement a variety of cyber security best practices to protect their systems and client data with compliance frameworks such as International Organization for Standardization (ISO) 27001, Center for Internet Security (CIS), or National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF). Additionally, implementing a commonly accepted privacy framework such as General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), or ISO 27701 provides your clients the confidence that you are taking the measures necessary to protect their data.
Which best practice(s) or compliance framework(s) is the right one for you? How will you meet the controls? The Choice CyberSecurity team is your partner to guide you through the compliance journey. We cut through the clutter and noise to make this process streamlined for your business.
Financial |
 |
Wealth Management, Insurance, Banks, and Credit Unions have their own set of compliances and best cyber security practices. At the foundation of all of these standards are the NIST 800-53 control framework.
The Security and Exchange Commission (SEC) provides guidelines around the NIST cyber security framework to provide safeguards. In addition, companies that are members of the Financial Industry Regulatory Authority (FINRA) must meet additional requirements to protect Personal Identifiable Information (PII) data. It’s essential to thoroughly understand each financial business’s requirements to ensure that the compliance and controls are selected and implemented.
Our industry expert can work with your company to select the proper compliance and best practices suitable for your company.
Insurance |
 |
Insurance companies need to follow a compliance framework based on the type of Personal Identifiable Information (PII) or Electronic Protected Health Information (ePHI) data they collect, store or transmit. In addition to federal compliances, insurance companies need to meet state laws they conduct business in.
Compliance regulations for insurance companies vary from state to state. The insurance sector is experiencing an increased interest in adding regulations. In our experience, this typically indicates that it could become a highly regulated industry in the future. For example, New York’s State Department of Financial Services (NYDFS) and Privacy Shield set new cyber security regulations for financial organizations and insurance companies. These cybersecurity-focused compliances are required for all financial and insurance companies that provide services in this state.
Choice can identify the compliance(s) and best practice(s) tailored for your company’s specific needs.
INDUSTRIES AND THEIR COMPLIANCES
Corporate compliance is a concept that varies from industry to industry. It’s the offensive line of most companies – not very glamorous, doesn’t generate revenue, but when something goes wrong – look who gets blamed. So, why would anybody want to be a compliance officer or absorb that risk?
The answer is that without the compliance officer, regardless of the discipline, any company probably won’t be around for very long. Those of us on the compliance side of the business know this, and though others may not admit it, they respect the team members that keep them out of trouble.
Often the cost of compliance is weighed against the benefits. Interestingly, compliance can even counter what most of us might consider ethical, and it’s not always a clear path.
Choice Cyber Solutions has compliance professionals across industries to guide and remedy to reduce risk and penalties of non-compliance.
Government
NIST 800-171
CMMC
NIST 800-53
ITAR
DFARS
Healthcare
HIPAA
HITECH
PCI
State/Federal Laws
ISO 27001
NIST
Technology
GDPR
CCPA
ISO 27001
ISO 27701
SOC 2
NIST CSF
Financial
NIST CSF
FFIEC
FINRA
FISMA
GBLA
GDPR
CCPA
NIST 27001
NIST 27701
NYDFS
PCI
ISO 27001
SEC
Insurance
NIST CSF
NIST 27001
NIST 27701
ISO 27001
GDPR
CCPA
NIST 27701
NYDFS
PCI
ISO 27001
SEC
