Articles by tag "compliance"
Ask Our VP of Compliance: July 2018
"HIPAA Compliance & HITRUST Common Security Framework”
In recent years, security breaches in the healthcare industry have become a lot more prevalent. The rise in data privacy violations, specifically infringements on the security of ePHIs (electronic Protected Health Information), has put millions of health records at risk. Surely, private data such as health information must always stay protected from unauthorized exposure, which is why HIPAA compliance and HITRUST CSF are so important. Digital Edge's VP of Compliance answers some key questions regarding HIPAA and HITRUST CSF!
The Equifax Effect: NYS DFS' Breach Response
The New York State Department of Financial Services (DFS) has recently issued a new regulation concerning Credit Reporting Agencies (CRA) with operations in New York, in response to the substantial data breach involving Equifax in 2017. This newly effective CRA regulation, called the “Registration Requirements and Prohibited Practices for Credit Reporting Agencies,” aims to protect New Yorkers from the possibility of data breaches by requiring credit reporting agencies to comply with the NYS DFS 500 Cybersecurity Regulations and to register with the DFS annually.
This announcement was made by NYS DFS Monday, July 23rd and will be implemented in 4 phases, the first one beginning in November. Digital Edge wants to inform all credit reporting agencies of this new requirement and offer our knowledge on DFS500 regulations. Learn more about this new regulation by reading the full article!
Digital Edge is an expert in ISO standards, and is certified by the International Standard Organization on Information Security and Quality (ISO 27001). There is a clear crosswalk between DFS law and ISO standards. Digital Edge will help to implement policies, standards and practices to cover all DFS requirements based on International Standards Organization framework.
Digital Edge Successfully Passed ISO 9001:2015 Audit!
On Tuesday, May 29th, Digital Edge passed the International Organization for Standardization’s (ISO) Quality Management Surveillance 1 Audit using the 9001:2015 framework! ISO is an independent, non-governmental international organization with a membership of 161 national standard bodies. ISO is credited for publishing more than 2100 international standards, covering almost every industry, from technology, to food safety, to aviation and healthcare.
Digital Edge is also certified in the ISO 27001:2013 framework for Information Security Management. The ISO 27001 is a specification for an information security management system (ISMS). Digital Edge protects businesses from threats, including internet fraud, hacking, overseeing of transactions and other cyber security threats. Digital Edge guarantees our clients are receiving outstanding services.
Digital Edge is offering assistance in becoming compliant for any type of standard or certification. Our VP of Compliance is knowledgeable in ISO, DFS, NIST, HIPPA, GDPR, as well as any other standard our clients want to be compliant with. Digital Edge also sends out monthly newsletters informing them about most asked questions regarding compliance and any questions submitted. Check out our Compliance page on our website!
Ask Our VP of Compliance: May 2018
"GDPR"
With the General Data Protection Regulation (GDPR) legislation set to go into effect on May 25th of this year, it’s no surprise that there has been a plethora of questions come our way regarding this data protection regulations. Digital Edge's VP of Compliance answers the most commonly asked questions!
- What are the key benefits for this regulation?
- What is meant by ‘personal data’ under this legislation?
- How do I now if my company needs to be GDPR compliant?
- What are the penalties for non-compliance?
- Do data processors need ‘explicit’ or ‘unambiguous’ data subject consent – and what is the difference?
- What about users under the age of 16?
- How do I know if I need to appoint a Data Protection Officer (DPO)?
- Under GDPR am I required to report a data breach? If so, what is the time frame?
Digital Edge Green Policy
Author: Danielle Johnsen (VP of Compliance)
Date: 22 May 2018
Version: 2.4
This document defines Digital Edge’s Green Policy.
Are You Ready for GDPR on May 25th?
Digital Edge is always working to stay compliant, which helps make compliance easier for your business.
Risk Driven Information Technology Organization
Or one may say Compliance Driven IT organization. As in the core of any today’s compliance lays Risk Management.
This article explains how to setup Risk Management practices for Cyber Security management. When it comes to Cyber Securty it's best to prepare for the worst-case scenario. It'll guide you on how to find ways to identify threats, face them and prepare to defend your business as well as give you templates to download to start your own risk management practice!
"The best garison is not the one that has lots of weapons but the one who has lot training."
-M. Petrov CEO
Ask Our VP of Compliance: April 2018
"DFS"
Last month, many New York State Financial Institutions received their scary “Failure to File Certification of Compliance” email and were perplexed by what to do next… Don’t fear, the Digital Edge's VP of Compliance is here to answer your many many submitted questions regarding NYS Department of Financial Services Part 500 Mandatory Cybersecurity Requirements! These are the questions for this month:
- I thought I was exempt and now I’m being notified that I’m PAST DUE, what do I do next?
- Where do I find a sample Certificate of Compliance? Do I have to create my own?
- What does Entity ID mean on the portal?
- Should I file this certificate if we are not yet in compliance with all applicable requirements of Part 500?
- This law requires me to report any cyber-security breach, is there a particular time frame?
- Are all Third-Party Service Providers required to implement Multi-Factor Authentication and encryption when dealing with a Covered Entity?
- What constitutes "continuous monitoring" for purposes of 23 NYCRR 500.05?
DFS - Certification of Compliance - Due 2/15/2018!
New York State Department of Financial Services recently updated its web page to indicate that any covered entities (i.e., agencies, insurance agents or insurance brokers) that already submitted their Certification of Compliance, needs to do so again after Monday, Jan. 1, 2018.
According to the department, "The Certification of Compliance certifies that a Covered Entity complied with 23 NYCRR 500 for the entire calendar year. As such, the department only expects to receive a Certification of Compliance between January 1 and the February 15 deadline for the previous calendar year. Unless a Covered Entity is ceasing department-authorized operations before that year end, a Certification of Compliance before year end will not satisfy the requirement that a Covered Entity certify its compliance as of year-end."
The NYDFS Cyber Security Regulation (23NYCRR500) requires all New York-licensed insurance agencies, agents and brokers to file a certification of compliance, prior to Thursday, Feb. 15, 2018, and annually thereafter. The certification confirms that the licensed entity has complied with the regulation to the extent required, which includes conducting a risk assessment and developing cybersecurity programs and policies based upon that risk assessment.
Digital Edge is an expert in ISO standards, is certified by International Standard Organization on Information Security and Quality (ISO 27001). There is a clear crosswalk between DFS law and ISO standards. Digital Edge will help to implement policies, standards and practices to cover all DFS requirements based on International Standards Organization framework.
Contact us today to further explore how our team can provide your business with an unparalleled cybersecurity solution, with our continued focus on Stability, Security, Efficiency and Compliance.
For more information on this regulation and to ensure that your organization is following the critical compliance requirements, please read our most recent articles:
Is Your Cybersecurity Infrastructure in Compliance?
In March of 2017, the New York State Department of Financial Services’ (DFS) issued its “Part 500” - Mandatory Cybersecurity Requirements for financial services entities. Thus, requiring banks, insurers, and other financial institutions to establish and maintain a “risk-based, holistic, and robust security program” that is ultimately designed to protect consumers’ private data. Partial exemptions are provided for covered entities based on their staffing level, annual revenue, or total assets.
The initial deadline for submitting an annual Certification of Compliance on February 15, 2018 is rapidly approaching, and all organizations are required to comply with DFS Part 500 Section 9, Risk Assessment by March 1, 2018.
Digital Edge is an expert in ISO standards, is certified by International Standard Organization on Information Security and Quality (ISO 27001). There is a clear crosswalk between DFS law and ISO standards. Digital Edge will help to implement policies, standards and practices to cover all DFS requirements based on International Standards Organization framework.
Contact us today to further explore how our team can provide your business with an unparalleled cybersecurity solution, with our continued focus on Stability, Security, Efficiency and Compliance.
For more information on this regulation and to ensure that your organization is following the critical compliance requirements, please read our most recent articles: