10 Compliance Standards That Are Must-Haves 

“The cost of non-compliance is great. If you think compliance is expensive, try non-compliance” – Former U.S. Deputy Attorney General Paul McNulty. 

These words ring truer than ever in today’s hyperconnected, data-centric world. Beyond the legal and financial ramifications, non-compliance can lead to plummeting valuations, reputational damage, and lost business opportunities. 

Adhering to relevant compliance standards is necessary, no matter the size of your company. Is it complicated? Sure. But the consequences of not getting on board are dire. 

TL;DR

Compliance is a set of established rules and guidelines for data protection and managing risks that governs how an organization can operate legally, ethically, and responsibly.

Key compliance standards include, SOC 2, GDPR, HIPAA, ISO 27001, PCI DSS, CIS, CCPA, CSA STAR, and NIST, among others.

The cost of non compliance does not only have monetary impact. It can also impact an organization’s reputation, loss of customer trust, and loss of business.

What are compliance standards? 

Compliance standards are a set of guidelines, rules, and best practices established by industry associations, government bodies or regulatory bodies to ensure that organizations operate in an ethical, legal, and responsible manner. 

Compliance standards typically address information security, privacy, risk management, and governance aspects of an organization. Here’s a breakdown on the type of compliance standards 

1. Regulatory compliance: These are mandated by law, and non-compliance with these frameworks is a non-starter. For example, GDPR, HIPAA, and PCI DSS.  

2. Industry-specific compliance: These are developed by industry associations as a set of best practices for a particular industry. For example, NIST cybersecurity for the technology sector, FISMA for federal agencies.
3. Operational compliance: These standards boost your goodwill as they focus on ensuring reliability, integrity, and efficiency of an organization’s operations and processes. For example, SOC 2, ISO 27001, COBIT for IT and governance. 

Let’s look at some of the most commonly accepted standards that range from regulatory compliances, laws and regulations, to industry best practices. 

List of compliance standards 

Compliance standards demonstrate your organization’s commitment to ethical practices, legalities, and most of all, data security. Here are the top 10 compliance standards that you need to consider. 

SOC 2 – Service Organization Control

SOC 2 is a framework that dictates how service organizations should process and handle customer information. It ensures the confidentiality, availability and integrity of the customer data. It was developed by the AICPA and is now one of the most commonly accepted standards. 

SOC 2 evaluates an organization’s controls on 5 Trust Service Criterias or principles, namely security, availability, processing integrity, confidentiality, and privacy. 

Any organizations that provide cloud-based services and SaaS solutions or processes customer data for other businesses should pursue SOC 2 compliance. This includes companies in healthcare, tech, and finance, as these are highly regulated industries that serve enterprise clients with stringent data security and protection laws and regulations. 

Who needs SOC 2? 

SOC 2 certification is primarily targeted towards service based companies that collect, store, and process data. This includes:

1. SaaS companies that manage customer information
2. Financial service providers
3. Healthcare companies that deal with patient data
4. Cloud service providers that offer storage or computing services. 
5. Payroll processing companies that handle employee information

Obtaining SOC 2 compliance is not a trivial undertaking and can vary based on the size, complexity of your organization, and the maturity of your current compliance program. Smaller organizations can find it particularly challenging since they would need to dedicate significant resources towards implementing SOC 2. 

For larger organizations that already have the resources, the road to compliance can seem comparatively easier, owing to their mature security infrastructure and policies. Even with a better security architecture in place, achieving and maintaining SOC 2 can still seem like a cumbersome and a time-consuming process. 

To achieve SOC 2 certification, you need an independent accredited third party auditor to validate the compliance and issue the official certificate.

HIPAA – Health Insurance Portability and Accountability Act 

HIPAA or the Health Insurance Portability and Accountability Act is a federal law that mandates the creation of national standards to protect sensitive patient data from being disclosed without the consent of the patient. Meeting HIPAA compliance requirements is mandated by law and it came into effect by the US Congress in 1996.  

HIPAA safeguards Protected Health Information (PHI) from unauthorized access, use, or disclosure. There are two components of this legislation, the Privacy rule and the Security Rule. 

The Privacy Rule has national standards for the protection of an individual’s medical information, giving patients control over their health information. 

The Security Rule establishes the standards for the security of ePHI, or electronic Protected Health Information. It requires covered entities to appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and security of ePHI. 

Who needs HIPAA? 

HIPAA applies to covered entities and business entities. Covered entities include healthcare insurance companies, healthcare clearinghouses, as well as hospitals, clinics, and doctors offices. Business entities include IT vendors that handle ePHI, accounting firms that provide services to healthcare providers, and third-party administrators that process claims. 

The cost of HIPAA noncompliance can range  from $100 to $1.5 million, depending on the frequency and level of negligence. There are certain HIPAA violations that you can be on the lookout for:

1. Divulging patient information without their consent.
2. Accessing a patient’s file without their consent.  
3. Non Secure standards for sharing protected health information.
4. Not communicating breach information on time. 

Check out this video where we take you through the basics of HIPAA compliance and crucial tips to help you achieve HIPAA compliance quicker. 

ISO 27001 – International Standard on requirements for information security management  

ISO 27001 is a standard for managing and implementing Information Security Management Systems or ISMS. It provides a comprehensive framework for organizations to manage and protect sensitive data and information.  

ISO 27001 covers an array of security measures, from access controls, and cryptography to incident management and business continuity planning. This standard is a great way to demonstrate your commitment to information security and build trust with your customers and stakeholders. 

Who needs ISO 27001? 

ISO 27001 is beneficial to organizations of all sizes and across any industry as information security is a concern for all organizations that handle information and data.  Although, it is particularly relevant for organizations that handle voluminous and sensitive data such as: 

• Healthcare providers
• Insurance companies
• E-commerce and retail
• Financial institutions and banks
• Government agencies
• Any public sector organizations 

In industries where data security requirements are highly regulated, obtaining a ISO 27001 certification can also be a contractual requirement. 

While it does not incur any penalties, not conforming to ISO 27001 could result in the removal of certification status and a loss of business opportunities if the organization is contractually obligated to do so.

GDPR – General Data Protection and Regulation 

Introduced by the EU in 2018, GDPR is a data protection law. It is a global standard for data privacy. The law lays down a strict set of rules for handling the personal information of EU residents, covering how it’s collected, used, and stored.

The regulation applies to all organizations handling the personal data of the citizens of the European Union, regardless of where the organization is located. The GDPR grants EU citizens a range of data subject rights that include: 

1. Right to access their personal data
2. Right to make amendments
3. Right to erasure
4. Right to object on how their data is being processed

Citizens of the EU have the right to access their personal data, make amendments, have it erased, and also reserve the right to object to how their data is being processed. 

Who needs GDPR?

Any organization that handles the personal data of EU citizens needs to comply with GDPR. This includes: 

• Social media platforms with EU users
• E-commerce and retailers that sell products and services to EU customers. 
• Hotels and airlines 
• Healthcare and financial institutions that treat and service EU citizens 

In case of non-compliance, organizations can be fined €20 million or 4% of their worldwide annual revenue, whichever is greater. The fines alone make GDPR a top priority but it also mandates strict data protection principles that includes purpose limitation, data minimization and storage limitation. Essentially, all your business processes will be embedded with the protection principles. 

GDPR also has a broad territorial scope which is why the challenge of implementing this regulation is magnified when it comes to larger organizations. They have to understand where all the personal data resides within their system, how it is being, and ensure that it is being handled properly. 

This is not to say that it is easier on smaller organizations. They may lack the resources and expertise to fully comprehend GDPR requirements. This is where outsourcing your compliance efforts to service providers can be beneficial. 

PCI DSS – Payment Card Industry Data Security Standard 

The Payment Card Industry Data Security Standard, PCI DSS for short, is a data security standard developed by credit card companies, namely VISA, AmEx, Discover, Mastercard, and JCB to ensure merchants, vendors, and service providers handle credit card data securely. 

The standard has 12 main requirements and can be organized into 6 categories: 

1. Building and maintaining secure network systems
2. Protecting cardholder data
3. Maintaining a vulnerability management program 
4. Implementing strong access control measures 
5. Monitoring and testing networks regularly 
6. Maintaining a security policy for sensitive information

These categories of PCI DSS cover various security measures, from firewalls and encryption to security policies. 

Who needs PCI DSS?

PCI DSS applies to companies that handle sensitive credit card information. Essentially, if a company collects, stores, processes, and transmits credit card data, you have to comply with the requirements. 

Example of companies that have to be PCI DSS complaint:

1. Financial institutions that issue credit cards.
2. E-commerce companies that accept credit card payments.
3. In-store retailers,
4. Web hosting companies.
5. Payment gateways. 

PCI DSS protects card data and sensitive authentication data like PIN, tracking data from the chip magnet, and validation codes. 

There’s no PCI DSS certification, instead companies demonstrate compliance through a process of self attestation that is carried out annually. Based on the volume of transactions, you either complete the Self Assessment Questionnaire (SAQ) or hire a Qualified Security Assessor (QSA) for a Report on Compliance (ROC). 

1. Level 1: Upwards of 6 million transactions per year. 

Annual ROC carried out by a QSA is necessary, and a quarterly network scan by an Approved Scanning Vendor(ASV). 

2. Level 2: Between 1 million and 6 million transactions per year.

Annual SAQ and a quarterly scan by an ASV. 

3. Level 3: 20,000 to 1 million transactions per year.

Annual SAQ and a quarterly scan by an ASV. 

4. Less than 20,000 transactions per year. 

Annual SAQ and a quarterly scan by an ASV in some cases. 

PCI DSS compliance can take anywhere from a day to 2 weeks. It all boils down to how long it takes to fill the assessment and pass the scans.

Noncompliance can have severe consequences with businesses losing the ability to carry out credit card transactions.  Penalties can also be substantial, running into tens and thousands of dollars. Additionally, the loss of business and the reputational damage that comes along with a data breach can erode customer trust and negatively impact your brand value, beyond repair. 

ISO 27017

ISO 27017 is an extension of the ISO 27001 standard, focusing specifically on information security management services or ISMS for cloud computing. It addresses the risks that are associated with cloud services.

It covers various aspects of data protection such as encryption, access controls, cloud data management, and incident handling. It also provides guidelines on selecting a cloud service provider. 

Who needs ISO 27017?

If your organization offers cloud services, ISO 27017 is crucial for you as it demonstrates your commitment towards maintaining a strong cloud security posture. While this is not a mandatory requirement, it can set you apart from your competitors. 

ISO 27017 outlines the expectations customers should have from their cloud service providers. 

CCPA – California Consumer Privacy Act 

CCPA is a privacy act that gives the residents of California control over their personal data. It came into effect on the 1st of Jan, 2020 and it applies to businesses that collect personal information of the residents of California.

Under CCPA, residents of California have the right to:

• know how their personal data is being stored, processed, and collected by businesses. 
• delete their personal data that is collected by businesses. Although this is subject to certain limitations. 
• opt-out or prevent the sale or trade of their data to third parties.
• non-discrimination for exercising their rights under CCPA.
• correct any inaccurate information. 
• limit the use and disclosure of the personal information that businesses have. 

Who needs CCPA?

The CCPA applies to you if you meet one of the following thresholds:

1. If your annual revenue exceeds $25 million. (It does not have to come from California alone). 
2. If you buy or sell data of 100,000 or more residents, consumers, or households annually. 
3. If you drive 50% or more of your revenue from selling the personal information of California residents.
4. If you hire California residents, even as contractors
5. If you pay taxes in California.
6. If you exchange goods or services, for monetary benefits, with the residents of California. 

As long as an organization collects personal data from California residents, it falls under CCPA. This includes situations where Californians provide their data while visiting the company’s website or using its app, even if those services are accessed outside California.

Cost of noncompliance may result in fines ranging from $2,500 per incident for accidental breaches to $7,500 per incident for intentional violations. These fines are imposed by the attorney general. Users affected by this breach can seek damages up to $750. 

Failure to give privacy notice before collecting personal information, not upholding “don’t sell my personal information” requests, not reporting data breaches, or not maintaining CCPA law compliance are a few common examples of CCPA violations that businesses should be aware of. 

CIS – Center of Internet Security 

CIS  benchmarks are a set of 18 best security practices for organizations to improve their cybersecurity. They are widely recognized as global standards for securing IT systems against the most pervasive threats. 

CIS benchmarks are a set of configurations for various security areas, such as:

1. Operating systems (Windows, Linux, macOS) 
2. Software applications
3. Server software security settings (email servers, databases) 
4. Cloud service providers (AWS, Azure, Google cloud) 
5. Mobile operating systems (iOS, Android) 

The CIS controls cover a wide range of security aspects, from data recovery and continuous vulnerability management to email and web browser protection and malware defense. These controls are divided into 153 safeguards and categorized into 3 groups: IG1, IG2, and IG3. They are implemented based on the need and maturity of the organization. 

Who needs CIS?

CIS benchmarks are relevant for all organizations. And because it maps to various regulatory compliances like NIST, HIPAA, PCI DSS, ISO 27001, etc it aids your compliance efforts.

Here are some industries that can benefit from adhering to the CIS benchmarks:

• Financial institutions – to protect sensitive cardholder data.
• Healthcare organizations – to comply with HIPAA regulations. 
• Educational institutions – to safeguard private student and faculty information and research data
• Retail and Ecommerce – to maintain PCI DSS compliance. 

Since CIS benchmarks are mapped to various regulatory compliances, noncompliance can mean data breaches or penalties.

NIST – Special publication 800-53

The NIST is a non-regulatory federal body within the US Department of Commerce. They develop cybersecurity standards and best practices for primarily federal agencies and their contractors. 

At its core, this framework provides a catalog of security and controls. It covers various touch points like access control, risk management, system maintenance, and incident responses.

The controls are adaptable, which allows the organization to tailor their implementation based on their risks and requirements. The flexibility it provides has made NIST 800-53 applicable to organizations beyond the federal agencies.

Who needs NIST 800-53?

The NIST 800-53 is a mandatory compliance for federal agencies and associated government contractors. But since it is a security framework, organizations can adopt this for a stronger cybersecurity posture. 

NIST CSF 

NIST Cybersecurity framework is a voluntary framework that manages cybersecurity risks. It has five core functions:

1. Identify:
   1. Identifying and cataloging your critical assets and risks.
   2. Understanding the legal and contractual obligations that impact your cybersecurity posture. 
   3. Establishing clear roles, responsibilities, and policies for managing the risks.
   4. Identifying vulnerabilities and threats and assessing their likelihood. 
   5. Developing a plan to address these risks.
2. Protect:
   1. Ensuring authorized access to controls and systems.
   2. Educating employees about cybersecurity.
   3. Protecting sensitive information.
   4. Patching and updating the system.
   5. Implementing firewalls, intrusion detection systems, and encryption.  
3. Detect:
   1. Identifying and analyzing unusual activities which could indicate a possible cyber attack. 
   2. Continuously monitoring systems for security. 
   3. Establishing a clear process to detect and report incidents. 
4. Respond:
   1. Have a plan of action for incident reporting, containment, eradication, and recovery.
   2. Establishing clear lines of communication and proper protocols for reporting of security incidents.
   3. Taking steps to mitigate the impact of incidents.
   4. Improving response plans based on previous incidents.
5. Recover:
   1. Restoring critical data after an incident. 
   2. Maintaining clear communications with the stakeholders. 

CSF, while specific, has room for flexibility so that you can customize it according to the needs of your organization.

To assess the progress of the implementation, CSF has 4 maturity tiers. 

Tier 1 (partial), Tier 2 (risk informed), Tier 3 (repeatable), and Tier 4 (adaptive). 

This framework is flexible and aligns itself with various other standards, making it a valuable tool for improving your organization’s cybersecurity posture. 

Who needs NIST CSF?

NIST CSF applies mandatorily to federal agencies and certain governmental entities. Private sector organizations can choose to comply with this standard as well. Primarily because NIST CSF gives businesses a better understanding of their cybersecurity threats and provides a framework on managing them.