Calculating the cost of GDPR compliance
The EU General Data Protection Regulation (GDPR) is unique in the field of compliance standards for its establishment of financial penalties for the loss or mismanagement of personal data of EU citizens. And those fines are higher and more likely to be assessed than any existing standard. Any company that does business with EU citizens (or controls or processes their personal data) is subject to fines calculated on three points:
- How much personal data of EU citizens has been mismanaged or lost
- What steps had been taken prior to the incident to avoid loss
- What steps were taken after a loss
If you handle little or no personal data of EU Citizens, you have well maintained, well documented and standard security processes in place and you take the compliance actions specified in the GDPR after discovering any data loss, then it will have little more impact on your company than the same loss anywhere else. Which isn't said to make little of how much a loss can cost.
Vulnerability Assessment, a pillar of the GDPR
VA is a key means of documenting that your security is up to snuff. The GDPR does not specify exact security requirements, but makes it clear that normal and usual security actions MUST be in place to be in compliance. VA as a security mainstay is in this category and scanning of infrastructure that collects, stores or transmits personal data is a must.
The EU GDPR compliance mandates that all organizations with access to Personally Identifiable Information of EU citizens take sufficient measures to ensure the security and privacy of their data. The GDPR will take effect on May 25, 2018 and it will run in parallel to other data protection directives. Compliance with SOX, HIPAA, ISO2700, etc. will help, but GDPR compliance has its own requirements, particularly regarding reporting. Wait a year to report a hack and you will pay a high price.
GDPR articles relating to Vulnerability Assessment
GDPR Article Vulnerability Assessment Requirement Article 32 (page52) Security of processing "1. ..... shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: (b)the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; VA measures and manages risk and ensures confidentiality, integrity and availability. When applied to processing systems, it can monitor systems against security policies, identify and track vulnerabilities and document corrective actions through log data. (d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing. Vulnerability Assessment is the central technology for testing, assessing and evaluating the effectiveness of measures taken to harden network resources against attack.
Article 39 (page 56) Tasks of the data protection officer "1. The data protection officer shall have at least the following tasks: ... (b) to monitor compliance with this Regulation, ..."VA provides reports which validate that appropriate security measures have been implemented and that action has been taken to mitigate vulnerabilities.
Article 57 (page 68) Tasks “… each supervisory authority shall on its territory: ... (h) conduct investigations on the application of this Regulation…Vulnerability Assessment reports provide details on asset inventory, identity and vulnerabilities. beSECURE provides a history of assets activity in log events for detailed investigations.
Article 59 (page 70) Activity reports "Each supervisory, authority shall draw up an annual report on its activities, which may include a list of types of infringement notified and types of measures taken in accordance with Article 58(2). ..."The results from VA scans can be used to contribute to an annual report. Contributions would include validation of compliance.
Fortra is ready to help our customers meet the risk identification, testing and evaluation aspects of the provisions within GDPR that affect Data Controllers and Data Processors. Moreover, in addition to specific clauses in article 32, Fortra provides capabilities with assessing host discovery, preventive vulnerability management and GDPR compliance.
Using VA to prepare for GDPR compliance
In preparing to meet GDPR compliance requirements, organizations must observe a minimum set of security controls to avoid both penalties and loss of customer trust. Those related to and delivered by VA are:
- Visibility of your IT environment which uncovers blind spots or shadow IT
- Continuous and automatic updates combined with full remediation capabilities
- Asset criticality rankings
- Reporting with full support for GDPR compliance
- Integration with your SIEM, ticketing system and other business-critical data
To attain GDPR compliance readiness, you need complete visibility into your IT assets through blind spot detection and an assurance that your applications are hardened against exploits and misuse. Fortra can help you address both known and unknown vulnerabilities hidden in your applications, assets and networks to meet any compliance challenge.
Beat the Business of Ransomware with this Guide
Ransomware has become a cybercriminal's staple business plan. Keep data protected with this guide, Beating the Business of Ransomware, and keep your cybersecurity measures finely tuned.