July 23, 2019 by Siobhan Climer and Mishaal Khan
Cybersecurity compliance frameworks, like the National Institute of Standards and Technology (NIST) and Consortium for IT Software Quality (CISQ) are useful as companies develop robust security postures. These frameworks provide a set of guidelines and minimal adherence policies that help keep organizations secure.
At the same time, depending on the industry, many businesses must also adhere to regulatory compliance frameworks, like the Health Insurance Portability and Accountability Act (HIPAA) and the Payment Card Industry Data Security Standard (PCI DSS).
How do these frameworks interact and overlap, if at all? How do businesses ensure that the cybersecurity vs regulation debate doesn’t leave them vulnerable to attacks or regulatory fines?
What Do We Mean By “Frameworks”?
Both cybersecurity and regulatory compliance frameworks seek to provide expert guidance on best practices for the respective oversight committees.
When it comes to cybersecurity vs regulation, both frameworks provide a set of policies, procedures, recommendations, tools, and adherence checklists that help organizations provide the best services and solutions while protecting consumers across the U.S.
Need to know which compliance frameworks apply to your organization, and which cybersecurity frameworks best apply to your business? Mindsight offers whiteboard sessions to help your organization determine a best path forward to protecting your business.
What Are Regulatory Compliance Frameworks?
A well-known example of a regulatory compliance framework is HIPAA.
Most individuals are familiar with HIPAA as it is used by health practitioners, clinics, and hospitals around the country to regulate the use, transference, storage, and sharing of personal health information (PHI).
HIPAA defines a set of mandatory controls that organizations must adhere to for compliance and regulatory purposes. A healthcare practitioner must demonstrate their commitment to protecting health data and remaining up-to-date on how technology and healthcare interact. According to the Office for Civil Rights of the Department of Health and Human Services, “Ignorance of HIPAA regulations is not considered to be a justifiable defense.”
Taking the HIPAA example one step further, a regulatory compliance framework is specific for organizations that fall under certain industry sectors or a contained governed body. HIPAA applies to many organizations that have PHI – from private doctors to health insurance providers – and is a perfect example of the complexity and expansiveness regulatory compliance frameworks often take.
Some other examples of regulatory compliance frameworks:
- Health Insurance Portability and Accountability Act (HIPAA)
- Payment Card Industry Data Security Standard (PCI DSS)
- Sarbanes-Oxley (SOX)
- International Organization for Standardization (ISO)
- General Data Protection Regulation (GDPR)
- California Consumer Privacy Act (CCPA)
While some of these regulations may levy fines for failure to meet compliance standards, others may remove business functionality.
Under PCI DSS – a set of credit card information and data protection standards maintained by several large credit card industry providers – businesses that fail to adhere to the frameworks are unable to process credit cards.
It’s easy to see how affected businesses would quickly be unable to conduct business.
What Are Cybersecurity Compliance Frameworks?
Cybersecurity frameworks typically provide recommendations for implementing and managing a security posture. Information security, at its heart, is about protecting data, so these frameworks focus on perimeter defense, access control, authentication, encryption, monitoring, reporting, risk management, and incident response.
Organizations can use these frameworks to build out hardened security postures or develop internal policies for security. Mindsight’s security experts use cybersecurity frameworks to help mitigate risk to our clients.
Whether the NIST or the CIS 20, cybersecurity compliance frameworks provide the necessary structure and organization for managing the complexity and ever-changing nature of data asset protection.
Some other cybersecurity compliance frameworks:
- National Institute of Standards and Technology (NIST)
- Center for Internet Security (CIS 20)
- Consortium for IT Software Quality (CISQ)
- Control Objectives for Information Related Technology (COBIT)
- Federal Risk and Authorization Management Program (FedRAMP)
- Privacy Shield
Strengthen Your Security Posture: Start With A Cybersecurity Framework
Cybersecurity Vs Regulation: What’s The Difference?
Whereas cybersecurity compliance frameworks focus on data, regulatory compliance frameworks are more consumer-focused. Yet overlaps certainly occur. Both HIPAA and PCI DSS regulatory regimes deal with the protection of industry-specific data, PHI and credit information, respectively.
Another difference in cybersecurity vs regulation is the ramifications. Regulations are required. Failure to meet those regulatory compliance standards as direct, stated consequences. On the other hand, cybersecurity compliance frameworks are more recommendations (highly recommended) for security.
The consequences are severe, yet also amorphous. Many attacks have financial impacts, such as ransoms or incident response enactment. At the same time, a cyber attack or data loss event often means significant damage to a business’ reputation. Those sorts of losses are frequently incalculable.
Dueling Frameworks Work Better Together
Mindsight recommends finding a security expert to guide you through a cybersecurity compliance framework implementation plan, which provides an umbrella security posture for your organization. Many of the protocols and policies within your security posture will help you meet the relevant regulatory compliance frameworks that apply to your business.
Learn more about how Mindsight helps clients protect your business and schedule a whiteboard session with us today.
Like what you read?
Contact us today to discuss cybersecurity vs regulation frameworks for your business.
About Mindsight
Mindsight, a Chicago IT services provider, is an extension of your team. Our culture is built on transparency and trust, and our team is made up of extraordinary people – the kinds of people you would hire. We have one of the largest expert-level engineering teams delivering the full spectrum of IT services and solutions, from cloud to infrastructure, collaboration to contact center. Our highly-certified engineers and process-oriented excellence have certainly been key to our success. But what really sets us apart is our straightforward and honest approach to every conversation, whether it is for an emerging business or global enterprise. Our customers rely on our thought leadership, responsiveness, and dedication to solving their toughest technology challenges.
Contact us at GoMindsight.com.
About The Authors
Siobhan Climer, Science and Technology Writer for Mindsight, writes about technology trends in education, healthcare, and business. She previously taught STEM programs in elementary classrooms and museums, and writes extensively about cybersecurity, disaster recovery, cloud services, backups, data storage, network infrastructure, and the contact center. When she’s not writing tech, she’s writing fantasy, gardening, and exploring the world with her twin daughters. Find her on twitter @techtalksio.
Mishaal Khan, Mindsight’s Security Solutions Architect, has been breaking and – thankfully – rebuilding computers for as long as he can remember. As a Certified Ethical Hacker (CEH), CCIE R&S, Security Practitioner, and Certified Social Engineer Pentester, Khan offers insight into the often murky world of cybersecurity. Khan brings a multinational perspective to the business security posture, and he has consulted with SMBs, schools, government institutions, and global enterprises, seeking to spread awareness in security, privacy, and open source intelligence.