Expansion is the key to business growth. European organisations can find tremendous opportunities for growing revenue by expanding into the United States (U.S.) market and winning over American customers. But for companies working in cloud technology or offering products that handle sensitive personal information, there are regulations and security compliance requirements specific to the U.S. that must be met in order to succeed in the world’s largest economy.

Successfully Expand into the U.S. Market

A Guide to Information Security Compliance

Security Compliance in the United States

ISO/IEC 27001:2013 is an international standard focused on information security. While it is mainstream in Europe and popular in the U.S., organisations seeking to expand into the States will need to go beyond ISO 27001 and look into complying with SOC 2, as well. Additionally, depending on the particulars of the business and its intended customers, an organisation may have to comply with other requirements such as SOC 1, HIPAA, FedRAMP, or FISMA.

Centres on the implementation and maintenance of an Information Security Management System (ISMS) to protect the confidentiality, integrity, and availability of information within an organisation. Once an organisation implements an ISMS, they will undergo an initial ISO 27001 audit by an accredited Certification Body and with a successful audit they will achieve an accredited ISO 27001 certificate.

ISO 27001

Organisations pick and choose which of five Trust Services Criteria categories they’d like to have evaluated. Instead of a pass/fail audit like ISO 27001, auditors deliver a report with their opinion on the design and effectiveness of the controls in place. The report can exceed over a hundred pages and is significantly more detailed than the one-page letter that accompanies an ISO 27001 certification.

SOC 2

Schedule a consultation

Ready to expand into the U.S. market?

How U.S. Security Compliance Standards Impact Your Business

Complying with U.S. security standards isn’t just the law, it can be an advantage to European organisations looking to break into the U.S. market. There are a number of benefits organisations can enjoy that relate to:

Barriers to Entry

Security Questionnaires

Client Trust

Competitor Differentiation

Investor & Stakeholder Value

Compliance reports, like SOC 2, allow organisations to avoid the requirement of completing countless vendor security questionnaires. Organisations can simply use their SOC 2 compliance report attesting to their information security capabilities instead.

Many U.S.-based organisations highlight compliance requirements early in the sales process when they consider a new vendor or partner. Non-compliant firms are likely to be barred from the bidding process.

The ability to demonstrate compliance is an advantage that can help an organisation win new clients and retain them over time, giving them an edge over competing, non-compliant organisations.

Trust is at the heart of all partnerships. Completing audits relevant to an organisation’s business provides assurance to clients that a firm is taking the appropriate steps to mitigate risk and can easily attest to the design and effectiveness of security controls in place.

Investors are likely to favourably view businesses that can attest to having proper security controls in place to protect data. Additionally, compliance reports not only demonstrate the maturity and viability of an organisation, but they also increase its enterprise value by giving it the ability to sell into regulated U.S. and global industries.

Barriers to Entry

U.S. Compliance Requirements

Federal Information Security Management Act (FISMA) focuses on the information security necessary for organisations to do business with a government agency. This applies to all organisations, unlike FedRAMP, which is specific to cloud service providers. FISMA assessments are performed by the agency directly or a 3PAO. Annual reviews are required and results must be reported to the Office of Management and Budget (OBM).

FISMA

SOC 2

SOC 1

HIPAA

FedRAMP

FISMA

Learn more

The Federal Risk and Authorization Management Program (FedRAMP) compliance is necessary for all vendors of cloud products and services that wish to do business with a U.S. federal agency. The program provides a standardised approach to security assessment, authorisation, and continuous monitoring for cloud products and services.

FedRAMP

FedRAMP assessments must be performed by an approved third-party assessment organisation (3PAO).

Under a “do once, use many times” approach, organisations that have achieved FedRAMP status can reuse their security package when selling to any federal agency.

Requires 3PAO

“Do once, use many times”

Their status will also be listed in the FedRAMP Marketplace, which is where federal agencies look when sourcing a new cloud service provider or offering.

FedRAMP Marketplace

Learn more

The U.S. healthcare industry is heavily regulated by laws designed to ensure the security of protected health information (PHI). According to HIPAA laws, vendors considered to be a covered entity (hospitals, surgeons, nurses, insurance providers, etc.) or business associates exposed to PHI (lawyers, accountants, IT specialists, etc.) must have measures in place to comply with the Privacy Rule and Security Rule. Failing to comply with HIPAA regulations will open an organisation to stiff penalties, such as hefty fines or even criminal charges in the case of gross negligence.

HIPAA

The Privacy Rule

Designed to protect individuals’ medical records and other individually identifiable health information.

Describes the required administrative, physical and technical safeguards that must be implemented to ensure the confidentiality, integrity, and security of electronic protected health information.

The Security Rule

Learn more

A SOC 1 audit evaluates the internal controls an organisation has implemented to protect client data. It differs from a SOC 2 audit in that it is focused specifically on the internal controls over financial reporting. A SOC 1 report is designed to help organisations comply with financial laws and regulations, improve adherence to corporate responsibilities, and combat accounting fraud.

SOC 1

Enterprises that should consider undergoing a SOC 1 audit include:

Payment processors Collections organisations Benefits administrators SaaS MSPs that handle sensitive financial data

Learn more

A SOC 2 audit assesses an organisation’s internal controls for keeping information safe and private. It reviews the policies, procedures, and systems designed to protect information across five categories called Trust Services Criteria. SOC 2 audits are intended for a broad group of organisations, including data centers, IT managed services, SaaS vendors, and other technology and cloud computing businesses.

SOC 2

Processing Integrity

This reviews whether a system achieves its intended purpose.

This examines the accessibility of the system, products, or services as set forth in the agreement signed by the relevant parties.

Availability

This principle refers to protecting system resources against unauthorised access. Proper controls can prevent system abuse, theft or other unauthorised use.

Security (Required)

Privacy

Confidentiality

This criteria refers to whether access and disclosure of information is limited to specific people or groups.

This area reviews the collection, use, retention, disclosure and disposal of personal information in accordance with an organisation’s privacy notice and the AICPA’s (American Institute of Certified Public Accountants’) generally accepted privacy principles.

Expand into the U.S. Market with A-LIGN

A-LIGN is a leading global cybersecurity and compliance firm for all compliance, cybersecurity, and privacy needs. With over 450 employees globally and more than 3,300 clients, A-LIGN is unsurpassed in helping firms navigate the complex U.S. compliance landscape. By partnering with A-LIGN, European organisations have access to one-stop compliance to achieve the highest level of security and confidently expand into the U.S.

A-LIGN’s broad range of services

Licensed SOC 1 and SOC 2 Auditor Accredited ISO 27001, ISO 27701 and ISO 22301 Certification Body Certified HITRUST Assessor Firm Accredited FedRAMP 3PAO CMMC Candidate C3PAO Qualified Security Assessor Company (QSAC) GDPR and CCPA Privacy Consulting Penetration Testing and Vulnerability Assessments

Additionally, A-LIGN’s compliance management platform, A-SCEND, helps organisations prepare for multiple audits simultaneously. Designed in consultation with auditing experts, the SaaS solution streamlines the audit process by centralising evidence collection, standardises compliance requests across multiple security frameworks, and consolidates audits to minimise expenses and improve productivity. The result: fast, frustration-free audits.

A-SCEND

Learn more

Ready to expand into the U.S. market?

SOC 2

A SOC 2 audit assesses an organisation’s internal controls for keeping information safe and private. It reviews the policies, procedures, and systems designed to protect information across five categories called Trust Services Criteria. These five categories include: Security Availability Processing Integrity Confidentiality Privacy SOC 2 audits are intended for a broad group of organisations, including data centers, IT managed services, SaaS vendors, and other technology and cloud computing businesses.

Designed to protect individuals’ medical records and other individually identifiable health information.

The Privacy Rule

Describes the required administrative, physical and technical safeguards that must be implemented to ensure the confidentiality, integrity, and security of electronic protected health information.

The Security Rule

Requires 3PAO “Do once, use many times” FedRAMP Marketplace

HITRUST

Learn more

The HITRUST CSF is a comprehensive, flexible, and certifiable security framework used by organisations across multiple industries to efficiently approach regulatory compliance and risk management. By pulling from major pre-existing frameworks and working with organisations to better understand their needs, HITRUST provides a complete, certifiable security and privacy standard. This standard gives customers confidence that their data and confidential information is secure.

The Benefits of HITRUST Certification:

Satisfies regulatory requirements mandated by third-party organisations and laws Accelerates your revenue and market growth by differentiating your business from the competition Saves time and money by leveraging a solid and scalable framework that includes multiple regulatory standards

HITRUST

Learn more