Can ISO 27701 guarantee GDPR compliance? ISO 27701 can well position any organisation for future GDPR compliance. While one is a management system and the other is a technically a legal framework, ISO 27701 helps to create a path on your journey to GDPR. “ISO 27701 and GDPR Compliance: What You Need to Know”
The ruling that the EU-U.S. Privacy Shield is no longer a valid data transfer mechanism under GDPR accelerated the timeframe for new SCCs, but there’s still work to be done. Here’s what you need to know to stay compliant.
The United States represents an attractive market for many European companies, but international expansion can be fraught with risk because of a completely different regulatory landscape.
“How European Companies Can Accelerate International Expansion with SOC 2 Compliance”
The National Institute of Standards and Technology’s (NIST) latest version of Special Publication 800-53 places an enhanced focus on privacy controls and supply chain risk management.
“NIST 800-53 Rev. 5 Adopts a Strategic Compliance Approach, Puts Privacy at a Premium”
On July 16, 2020, the Court of Justice of the European Union (CJEU) issued a landmark judgement that Privacy Shield is “invalid” because it does not provide “adequate protection” under Article 45 of the General Data Protection Regulation (GDPR) for transfers of personal data of individuals located in the European Union to the United States. “Privacy Shield and the GDPR: Inadequate Protection for Cross-border Data Transfers”
Let A-LIGN guide your journey from Information Security Management System (ISMS) to Privacy Information Management System (PIMS) “ISO 27701 Streamlines Data Privacy, Incorporates GDPR and CCPA concepts into Certifiable Standard”
What is ISO 27701?
The ISO/IEC 27701:2019 standard was published on August 6, 2019, and provides the requirements and guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS) as an extension of ISO/IEC 27001:2013 and ISO/IEC 27002:2013. This extension replaces the development standard ISO 27552.
A strong cybersecurity and risk posture is increasingly important in today’s business world, which is why it is imperative that private equity investors build cybersecurity and privacy modules into their due diligence. “Why Cybersecurity and Privacy Due Diligence is Important for Private Equity Firms”
Since 2007, the HITRUST Common Security Framework (CSF) has been recognized as a well-rounded and certifiable security framework for any organizations of all sizes and industries. With the upcoming CSF v9.3 update, HITRUST continues to demonstrate its value for any organization by expanding to incorporate new frameworks, legislation and standards.
What is the HITRUST CSF?
The HITRUST CSF is a scalable and extensive security framework used to efficiently manage the regulatory compliance and risk management of organizations. By unifying regulatory requirements and recognized frameworks from ISO 27001, NIST 800-171, HIPAA/HITECH, PCI DSS, GDPR and more into one comprehensive system, the HITRUST CSF saves time and energy by assessing once and reporting many.
Thanks to its ability to combine several assessments and frameworks into one framework, the HITRUST CSF allows clients to decide what they want to test against and get controls based on that level of risk. This “assess once, report many” approach means that assessors are performing several different audits, but the organization feels like they’re only undergoing one. Because of this benefit and its exhaustive focus on security, the HITRUST CSF has been adopted by organizations across different industries.
Originally designed specifically for the healthcare industry, the recent HITRUST CSF v9.2 grew the framework to make it useful for any organization around the globe.
CSF v9.3 will be released Q3 of 2019 and the HITRUST organization has detailed the additional regulatory factors that will be added to the framework.
Incorporation with the California Consumer Privacy Act
One of the most notable updates in CSF v9.3 is the incorporation of new standards and regulations, including requirements placed on organizations by the California Consumer Privacy Act (CCPA).
Passed in 2018, the CCPA was built to be similar to the European Union’s General Data Protection Regulation (GDPR) and takes a stronger stance to protect the sharing, transmission and storage of consumer data. The CCPA legislation goes into effect on January 1, 2020, with the enforcement of the law starting on July 1, 2020.
Not only does the HITRUST CSF v9.3 incorporate standards and regulations from the CCPA, it reflects key differences between the CCPA and GDPR, including requirements for data access, applicability and requirements for opt-out methods.
Other Important Updates to CSF v9.3
Aligning the HITRUST CSF with the CCPA is only one of the updates to the HITRUST framework. CSF v9.3 also updates the framework to incorporate other authoritative sources, including:
- The Federal Risk and Authorization Management Program (FedRAMP)
- The National Institute of Standards and Technology’s (NIST) Framework for Improving Critical Infrastructure Cybersecurity: Framework Core – Subcategories, v1.1
- Centers for Medicare & Medicaid Services’ (CMS) Information Security ARS: CMS Minimum Security Requirements for High Impact Data, version 3.1
- IRS Publication 1075: Tax Information Security Guidelines for Federal, State and Local Agencies: Safeguards for Protecting Federal Tax Returns and Return Information
- South Carolina’s Bill 4655, the Insurance Data Security Act
Who Should Migrate to CSF v9.3
If your entity wants to add any of the six regulatory factors outlined above to your HITRUST assessment, you will need to undergo CSF v9.3. If you are not interested in adding these factors, you can instead opt to undergo CSF v9.1 or CSF v9.2.
By giving organizations more choice to better fit their needs, the HITRUST CSF continues to position itself as a valuable, powerful and flexible framework for organizations of all sizes across all industries.
The A-LIGN Difference
A-LIGN’s experience and commitment to quality helped over 130 clients successfully achieve HITRUST certification. Our vigorous process outlined above helps you prepare for the HITRUST assessment, and our team of HITRUST experts are here to answer any question you might have through every step of the process by answering all inquiries within twenty-four hours. With A-LIGN, you’re on the right path to HITRUST certification success.
Interested in pursuing the HITRUST CSF for your organization? Contact A-LIGN at 1-888-702-5446 to speak with one of our cybersecurity and compliance professionals.
Enacted on May 25, 2018, the General Data Protection Regulation (GDPR) shook up the privacy world by enacting some of the strongest consumer protection laws ever seen. Any industry that processes the personal data of European Union residents was affected, and the regulation was designed to force organizations to implement the appropriate processes to manage consumer privacy and build consumer trust.
One year later, we reflect on what’s changed – and where we’re headed in 2019.