As more and more of our lives go online, every business owner needs to be on top of the ever-changing IT compliance landscape.

Here is a topline review of some of the basic compliance levels and the adherence companies need to follow. If this information seems like just a sea of acronyms, you can always reach out to us for help with compliance for your organization.

CCPA Compliance

The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them. This landmark law secures new privacy rights for California consumers, including: 

• The right to know about the personal information a business collects about them and how it is used and shared;
• The right to delete personal information collected from them (with some exceptions);
• The right to opt-out of the sale of their personal information; and
• The right to non-discrimination for exercising their CCPA rights. 

Businesses are required to give consumers certain notices explaining their privacy practices. The CCPA applies to many businesses, including data brokers. You must also have a “data breach” response plan in place.

The California Consumer Protection Act went into full effect on January 1, 2020. 

This is important to your business even if you do not currently operate or do business in California. The general feeling is that these regulations will roll out to all 50 states eventually as concerns of data privacy grow. So it is best to prepare by following these guidelines even if they have not been enacted in your state. Nevada, New York, Florida and Virginia, to name a few, have followed California’s lead in this data privacy trend.

>> Choose IT support with our Managed IT Checklist

CMMC Compliance

If you work with the Department of Defense as one of its contractors, then you will need to follow Cybersecurity Maturity Model Certification (CMMC) compliance.

The CMMC framework incorporates the processes, practices and approaches for the purpose of standardizing the assessment of a DoD vendor’s capabilities. The primary goal of the CMMC is to safeguard what is referred to as controlled unclassified information (CUI) across the DoD supply chain. 

CUI refers to any information or data created or possessed by the government or another entity on the government’s behalf. The interpretation of data is broad here and can take into account financial, legal, intelligence, infrastructure, export controls or other information and data.

GDPR Compliance

The European Parliament adopted the General Data Protection Regulation (GDPR) in April 2016. This provision applies to all 28 European Union (EU) member states. This regulation protects EU citizens’ personal data during transactions in EU states.

The GDPR states that organizations must provide a “reasonable” level of protection for personal data. If companies fail to comply, the GDPR governing body can assess fines. 

HIPAA Compliance

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule provides consumers with important privacy rights and protections with respect to their health information. It includes important controls over how their health information is used and disclosed by health plans and healthcare providers. 

Ensuring strong privacy protections is critical to maintaining individuals’ trust in their healthcare providers and willingness to obtain needed healthcare services, and these protections are especially important where very sensitive information is concerned, such as mental health information. 

>> Choose IT support with our Managed IT Checklist

PCI DSS Compliance

Payment Card Industry Data Security Standard (PCI DSS) protects the storage and transmission of credit, debit and cash card information by businesses. Compliance with PCI creates a foundation of mutual benefits for both you and your customers.  

You can provide your customers with active data protection plus seek out potential threats before they arise. This is done by building and maintaining secure networks and systems, starting a vulnerability protection program and regularly monitoring and testing your network for vulnerabilities. 

To protect customer payment data plan to:

• Implement access control.
• Limit the parties that can access data in the first place. 
• Maintain an open mission statement regarding your information security policy.

SOX Compliance

Sarbanes-Oxley (SOX) Act compliance of 2002 focuses on protecting investors. If you’re an officer of a publicly traded company or about to offer an IPO (initial public offering), this applies to you. SOX mandates that companies are transparent with their financial information for shareholders. 

The audits that go along with SOX improve earning reporting and increase the reliability of corporate disclosure. Your company realizes more benefits via the streamlining of business practices that SOX fosters. It can be a bit more costly on the accounting side but will be worth it if you are planning an exit or IPO.

>> Choose IT support with our Managed IT Checklist

How We Can Help?

In our ever-changing data privacy world, it is best practice to stay on top of the changes. By partnering with a reliable managed services provider like Internos, you can navigate these tricky waters. We serve as your partner in meeting all compliance standards. Implementing compliance management solutions will actively safeguard your clients’ confidential data, which today’s consumers are demanding.

Contact us today to begin the steps toward ensuring compliance and see how we can help you spell out success.