4 Practical Ways to Cure Your IT Compliance Headaches

Compliance is always one of the biggest headaches for any business, and this is likely to become an even bigger concern in the coming years.

As the amount of highly sensitive and personal data firms possess grows, customers are more aware than ever of the value of this information, and will have high expectations that companies treat it with care.

It's not just growing consumer expectations that have to be met. In today's environment, regulators are demanding more of businesses than ever, with new rules on both sides of the Atlantic seeking to minimize the amount of data businesses can collect, more strictly govern what it can be used for, and put in place tougher financial penalties for any failures in consumer data protection.

Indeed, regimes such as GDPR mean fines for data breaches can be much more than just a minor nuisance for the largest firms, as was often the case in the past. European regulators have handed out hundreds of millions of dollars in fines since the implementation of GDPR in 2018, and jurisdictions in the US are set to follow suit thanks to the likes of the California Consumer Protection Act.

Therefore, keeping up with compliance is vital for both the financial security of a firm and its reputation. And there are likely to be a few key headaches to be addressed that are common to many businesses. Therefore, here are four essential steps to better ensure your data compliance.

1. Get control of your BYOD

One of the biggest challenges when it comes to compliance is keeping control of the vast range of mobile devices that employees now use for work purposes. Large firms may have hundreds or even thousands of smartphones, tablets and other personally-owned gadgets in use around the network, which could each pose a serious security vulnerability.

If you aren't managing these properly, you can't be sure data is being accessed securely, or if there are any apps that contain malware on a user's phone. Then there’s the risk that a device containing sensitive data may be lost or stolen, which could also lead to a costly data breach.

To avoid these risks, a strong bring your own device (BYOD) management program is essential. This should spell out exactly what users can and can’t do when using mobile gadgets for work, and mandate the use of mobile device management software to protect company assets.

2. Closely manage your vendors

Even if you're certain your own network is secure and compliant, can you say the same for your suppliers and other third-party contacts? Some of the world's highest-profile breaches have been traced back to these vendors, and they could occur anywhere within your supply chain.

The 2013 hacking attack on Target, for instance, was said to originate in its HVAC supplier, while the 2015 Home Depot attack came via stolen vendor login details that allowed hackers to access its point-of-sale system. Both breaches exposed millions of customer records and led to large class-action settlements for the firms.

Incidents like this therefore highlight the importance of having close control of all vendors in order to ensure compliance in any areas where there are electronic data interchanges. Effective vendor management can be a complex process, especially for larger forms with sprawling supply chains, but are essential for keeping these risks under control.

3. Keep your software up to date

Another major cause of a data breach is the failure to update software that contains known vulnerabilities which caused the hacking of Equifax in 2017. However, despite the risks associated with out-of-date software, many firms still don’t do this often enough.

In the healthcare sector, for example - which has particularly tough compliance requirements such as HIPAA - one survey found 57% of firms have experienced at least one data breach as a result of hackers exploiting a vulnerability for which a patch had previously been released. However, two-thirds of companies didn’t even realize they were at risk.

A clear schedule for patching and upgrading IT solutions is therefore vital. This process may be tedious and time-consuming, but regulators will look very disfavorably on any breach that takes advantage of known vulnerabilities.

4. Don't overlook the Internet of Things

Another growing area of concern for many businesses is the impact of the Internet of Things (IoT) devices on their compliance efforts. Billions of these devices are set to be added to enterprise networks in the coming years, but there are still few industry-wide security standards for them, meaning many of them don't have robust protections in place. Common issues include weak or non-existent encryption and widespread use of default passwords.

The addition of many new endpoints to firms' networks that don’t have the same level of safeguards as traditional devices presents huge opportunities to hackers and should be a cause for concern far beyond simply ensuring compliance. While any data breach can cause financial or reputational damage, attacks targeted at IoT devices could even lead to physical harm.

As a result, businesses need to pay particularly close attention when adding these items to their network, and even consider setting up different architecture to limit their access to sensitive data.