IT Compliance and Cyber Security: Understanding the Differences

IT compliance and cyber security are often used interchangeably, even within the cyber security and compliance fields. This is the basis for the completely incorrect and dangerous notion that achieving compliance automatically equals being secure.

While there is some overlap, and the two fields complement each other, IT compliance and cyber security are not the same, and being compliant – with HIPAA, FedRAMP, PCI DSS, or any other framework – is not the same thing as being secure.

What is cyber security?

Cyber security is the protection of computer hardware, software, systems, networks, and data from cyberattacks. It is a very broad field that encompasses an enterprise’s policies, processes, end user education, and technical controls to address the following areas:

• Application security – securing software and apps
• Information security – securing data, including customer data, employee data, and confidential business information
• Network security – securing the ports and databases within a network
• Operational security – classifying information assets and determining the controls needed to secure them
• Cyber incident management and response

What is IT compliance?

There is much overlap between the goals of IT compliance and cyber security, which is the root of the confusion. They both address securing hardware and digital assets. However, unlike cyber security requirements, which are developed internally, IT compliance requirements are mandated by a third party, such as the government, an industry regulatory body, or a client.

• Organizations operating in the healthcare industry in the U.S. must comply with HIPAA, a federal law
• Organizations around the world that wish to accept major payment cards must comply with PCI DSS, a set of standards mandated by the major credit card brands
• The U.S. federal government requires organizations that wish to sell cloud services to federal agencies to comply with FedRAMP
• Many private-sector businesses require their cloud services vendors to release an SOC 2 attestation

The takeaway is that enterprises implement cyber security controls for their own protection; they undergo IT compliance audits to satisfy a third party.

What are some additional differences between cyber security and IT compliance?

While many IT compliance standards, such as FedRAMP and SOC 2, are quite rigorous, they are not meant to provide full cyber security protection on their own. There’s no way they could.

• The cyber security threat landscape is dynamic; it changes on a daily basis. IT compliance frameworks change very slowly, typically annually or less often.
• Every organization’s data environment and risk profile are different. No IT compliance framework could comprehensively address every possible eventuality at every organization.

Additionally, some IT compliance regulations, such as the GDPR and the California Consumer Privacy Act, focus more on data privacy (giving individual consumers control over the data enterprises collect from them) than cyber security (protecting enterprise assets).

IT compliance complements cyber security

With the costs of IT compliance skyrocketing, some enterprises view compliance quite negatively, as a list of line items that must be checked off to conduct business in a certain industry or with certain clients. However, IT compliance complements enterprise cyber security and provides numerous benefits.

Compliance with certain standards, such as FedRAMP and SOC 2, is seen as a “gold standard” of data security by companies seeking to purchase cloud services, and compliance with the GDPR is seen by some consumers as a testament to a company’s commitment to data privacy. The process of undergoing a compliance audit also helps companies identify issues with their cyber security and data governance that may have otherwise gone undetected. Finally, IT compliance frameworks provide a good starting point for enterprise cyber security.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

Understanding FedRAMP security impact levels and baselines

You would never pay $1,000 upfront and $30/month for a security system to protect a shed containing $100 worth of lawn equipment. However, you wouldn’t hesitate to spend that much or more to protect your home and family. The same concept applies in information security. Different kinds of data necessitate different levels of security, which is why FedRAMP security impact levels exist. A government agency that deals with data that is widely available for public consumption doesn’t require as many security controls as an agency that works with classified data.

There are three FedRAMP security impact levels: FedRAMP Low, FedRAMP Moderate, and FedRAMP High. They are based on the three FISMA security objectives outlined in the Federal Information Processing Standard (FIPS199):

• Confidentiality: Protect personal privacy and prevent the unauthorized disclosure of proprietary information.
• Integrity: Prevent the unauthorized modification or destruction of information.
• Availability: Prevent disruptions to information access or use.

FedRAMP Low Security Impact Level

The FedRAMP Low Impact Level applies to cloud service offerings (CSOs) that will be used to work with data that is already publicly available; a breach of this data would not cause significant damage to the government agency or its operations, assets, or individuals. FedRAMP defines two baselines within the Low Impact Level category, the standard Low Baseline and what is known as the LI-SaaS Baseline.

The LI-SaaS Baseline applies to Low-Impact SaaS applications that do not store personally identifiable information (PII) other than what is generally required for login credentials, such as email addresses, usernames, and passwords. The LI-SaaS Baseline has fewer security controls that require testing and verification than the standard Low Baseline, and the required security documentation is consolidated.

FedRAMP Moderate Impact Level

This is the most common impact level, accounting for about 80% of CSOs that attain FedRAMP authorization. It applies to CSOs being used for data that is largely not available for public consumption, such as PII. If Moderate Impact data is breached, the agency’s operations, assets, or individuals would suffer serious adverse effects, such as operational damage, financial loss, or individual harm (though not physical harm or death).

FedRAMP High Impact Level

The FedRAMP High Impact Level, which was released in 2016, applies to CSOs being used by agencies that handle the most highly sensitive unclassified government data, such as law enforcement, emergency services, financial systems, and healthcare systems. A data breach could have catastrophic results, including loss of human life and economic crises. FedRAMP High systems must comply with 421 controls and reduce the probability of human error as much as possible by automating as many processes as possible.

When pursuing FedRAMP authorization, cloud service providers must ensure that they choose the correct security impact level for their CSOs. For example, cloud service providers whose CSOs qualify for standard Low Baseline or LI-SaaS would not decide to pursue a JAB P-ATO, which is more appropriate for CSOs that are Moderate and High Impact.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

Your guide to the SOC 2 Trust Services Criteria (formerly the Trust Services Principles)

Outsourcing IT services to service organizations has become a normal part of doing business, even for small companies. However, there are risks to using service providers, and these continue to evolve and change. In this dynamic environment, the American Institute of Certified Public Accountants (AICPA) made some changes to the SOC 2 Trust Services Criteria in April 2017, effective for all SOC 2 attestations with period ends after December 15, 2018.

If your company is issuing an SOC 2 attestation this year and moving forward, you must map your controls to the new SOC 2 Trust Services Criteria requirements.

The SOC 2 Trust Services Principles are now the Trust Services Criteria

AICPA has renamed what used to be called the Trust Services Principles, or the Trust Services Principles and Criteria. They are now known as the Trust Services Criteria. Additionally, the five principles that comprise the criteria are now called the Trust Services Categories.

What are the five criteria categories?

• Information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems and affect the entity’s ability to meet its objectives.
• Information and systems are available for operation and use to meet the entity’s objectives.
• Processing integrity. System processing is complete, valid, accurate, timely, and authorized to meet the entity’s objectives.
• Information designated as confidential is protected to meet the entity’s objectives.
• Personal information is collected, used, retained, disclosed, and disposed to meet the entity’s objectives.

Security is the only Trust Services Criteria category that organizations are required to include in their SOC 2 attestations. Organizations can attest to controls in the security category only or pair it with any or all of the other categories.

Integration with the 2013 COSO Framework

To better address cybersecurity risks and expand the assessment environment, the SOC 2 Trust Services Criteria have been integrated with the 2013 COSO Framework. Developed by the Committee of Sponsoring Organizations of the Treadway Commission, the framework was designed so that publicly traded companies could assess and report on their internal controls. This integration was the driving force behind renaming the SOC 2 Trust Services Criteria, as the old nomenclature would have caused confusion with the terms used in the 2013 COSO Framework.

The 2013 COSO Framework contains 17 principles, which are grouped under five internal control classifications:

• Communication and Information
• Control Environment
• Monitoring Activities
• Risk Assessment
• Control Activities

If your organization has issued an SOC 2 report previously, you will likely have to restructure your controls to comply with the new integration.

Additionally, service organizations will have to include the “points of focus” required by COSO, which are new to SOC 2 attestations. Each Trust Services Criteria category now has several points of focus that detail the features that should be included in the design, implementation, and operation of the control related to that criterion. Not all points of focus will apply to every organization.

Which Trust Services Criteria categories apply to your company?

The first step to issuing an SOC 2 attestation is determining which Trust Services Criteria categories to include. All of them may be applicable to your service organization, or perhaps only security will be relevant. Make sure to get advice from SOC 2 experts such as the professional SOC 2 auditors at Continuum GRC.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.