CompliancePoint:
Information Security

What do Canada’s New Data Breach Reporting Requirements mean for US-Based Businesses?

Matt Cagle, Information Security

On November 1st the data breach reporting requirements under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) went into effect. US companies should be aware of these requirements and evaluate their operations to determine the applicability as well as what adjustment may be required to… Continue Reading

ICO issues £500,000 fine against Facebook for Cambridge Analytica scandal

Mackenzie Frerich, GDPR

To give a little background, in March of this year, an exposé published in the Guardian and New York Times revealed that the personal data of 87 million Facebook users, 1 million of which were UK Facebook users, was harvested from their profiles through personality quizzes… Continue Reading

Social Engineering –  How to Protect Yourself and Your Company

Bruce Josephs, Information Security

Social Engineering is a low-tech method used for gaining access to resources whether they are physical, technical, monetary, or informational (e.g. trade secrets, confidential).   Phishing is one example of Social Engineering What is Social Engineering? Social Engineering is the art and science of getting people… Continue Reading

Risk Analysis vs Gap Analysis – Knowing the Difference is Important

Martha Raber, HIPAA HITRUST

As a Certified HITRUST Assessor and career healthcare compliance and security specialist, I was very pleased to see OCR’s April Cybersecurity newsletter highlighting the differentiation between a HIPAA RISK Analysis and a HIPAA GAP Analysis.  The confusion or lack of true understanding around the difference in these two… Continue Reading

GDPR – Idenfifying your risks

Michael Kramer, GDPR

As the GDPR enforcement date is upon us, many companies are shifting into panic mode trying to really understand not only what the GDPR means to their company operationally, but also where their true risk lies.  How do they evaluate that risk?  How do they… Continue Reading

GDPR & IKEA

Jordan Eisner, Customer Engagement GDPR

How does the GDPR compare to IKEA? Well they’re both European for starters, and while IKEA is #trendy, GDPR is #trending. With the work I’ve done with clients utilizing our consulting services for GDPR support (which is primarily serving as liaison between the client and… Continue Reading

GDPR Workshop Reflections & Takeaways

Rob Tate, GDPR

“It was the best of times it was the…” No really – it was great!  What an exciting opportunity we had at CompliancePoint last week as we hosted our workshop in Atlanta, “Navigating the GDPR.”  As described at the event our goal was more interactive… Continue Reading

Understanding HITRUST’s Role in Healthcare

Martha Raber, HITRUST Information Security

  HITRUST addresses challenges within Healthcare As the most widely adopted framework within the healthcare industry, the Health Information Trust Alliance (HITRUST) was created to provide a certifiable standard for health information systems and exchanges that create, access, process, store or exchange protected health information… Continue Reading

Finding Regulatory Synergies Within the HITRUST Framework

Martha Raber, HITRUST Information Security

HITRUST certification can support compliance with many other healthcare related regulations. Currently there are many regulatory obligations placed on healthcare security and privacy officers.  The need to comply with a multitude of standards, laws, and regulations can be daunting.   There are synergies and overlaps,… Continue Reading

The Equifax data breach, PCI, and you

Gates Marshall, Information Security

How adhering to PCI-DSS principles could have prevented a data breach The series of breaches recently publicly disclosed by Equifax could have been prevented by following PCI DSS guidelines.  PCI DSS is an internationally accepted standard of controls which, when applied at the most basic levels,… Continue Reading