Navigating Compliance Requirements

1. Navigating Compliance Requirements DCM 6.2 Regs and Codes linford&collp

2. Navigating Compliance Requirements Data centers may choose to comply with many different rules and regulations such as, HIPAA, SSAE 16 (f. SAS 70), ISO, LEED, etc. We will break down the requirements and discuss where overlaps exist, how to leverage work between audits, and how to minimize audit impact.

3. Myriad of Regulations, Frameworks and Standards

4. HIPAA • Health Insurance Portability and Accountability Act of 1996 • Privacy rule • Security rule – Three types of safeguards • Administrative • Physical • Technical • Required vs. addressable specifications • Why would a data center choose to be HIPAA compliant? • House ePHI for clients

5. HIPAA Continued • How to demonstrate compliance • No HIPAA “certification” • Self audit • Independent audit • Cost of compliance • Resource to implement required policies and procedures and perform self assessment • Independent audit – 10K to 100K – depending on size and complexity • Cost of breach

6. FISMA • Federal Information Security Management Act of 2002 • Requirements • Categorize information systems according to risk level (FIPS 199) • Security controls • Risk management • System security plan • Why would a data center need to be compliant with FISMA? • House federal agency clients or contractors to federal agencies

7. FISMA Continued • How to demonstrate compliance • No FISMA “certification” • Independent audit • Cost of compliance • Resource to implement required policies and procedures, perform risk assessment, implement controls to remediate gaps • Independent audit – 20K to 100K – depending on size and complexity

8. ISO 27001:2005 • Information security standards published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in 2005 • Requirements • Specifies a security management system • Required Every three years • Why might a data center choose to be ISO certified? • Data center is located outside of the United States • Data center does business with European clients

9. ISO 27001:2005 Continued • How to demonstrate compliance • Certification by an ISO Registrar • Cost of compliance • Readiness assessment and consultations necessary • Separate ISO Registrar necessary • 50K to 100K+ Every Triennial

10. Payment Card Industry Data Security Standard– (PCI DSS) • Created by credit card companies to protect cardholder data • Requirements • 12 PCI DSS requirements • Service dependent • Why might a data center choose to be PCI certified? • Have credit card merchants or PSPs for clients • Client requirements

11. PCI DSS Continued • How to demonstrate compliance • Self assessment questionnaires (SAQ) • PCI Report of Compliance (ROC) • Listing on Credit Card Company’s Directory • Cost of compliance • Only QSAs Can Perform • 15K to 100K+ Per Annum

12. LEED System • LEED - Leadership in Energy and Environmental Design – Designed by the US Green Building Council in 1998. • Requirements • Voluntary • Energy efficiency evaluation • Four categories (Certified, Silver, Gold, and Platinum) • Why might a data center choose to be LEED certified? • Lower operating costs and increased asset value • Demonstrate energy efficiency to clients and prospects • Qualify for tax rebates, zoning allowances and other incentives

13. LEED Continued • How to demonstrate compliance • Project must satisfy LEED prerequisites and earn a minimum of 40 points on a 110 point LEED rating scale • Independent, third party verification that a company meets LEED • Cost of compliance • Implement LEED prerequisites to earn enough points to satisfy desired level of LEED certification – cost varies by project • Certifications fees vary by project size, the average cost is $2000

14. Service Organization Control Audits - SOC 1, 2, 3 • SOC 1 / SSAE 16 – (f. SAS 70) – Statement on Standards for Attestation Engagements • Internal Controls over Financial Reporting (ICFR) • SOC 2 and SOC 3 • Security, Availability, Processing Integrity, Confidentiality, or Privacy • Detailed vs High-Level • Why might a data center choose to obtain a SOC report? • Hosting General Ledger or ERP Systems • User Auditors’ Requirement

15. SOC 1, 2, 3 Continued • How to demonstrate compliance • Internal Controls In Place • Design Effectiveness • Operating Effectiveness • Cost of compliance • Only CPA Firms with Specialists Can Perform • 15K – $1M+ Per Annum

16. Ways to Demonstrate Compliance • Internal Testing • Independent Audits • Various External Audits

17. Cost of Compliance • Expensive • Value Judgment • How much is the customer or potential customer worth to company? • How much are lost or failed opportunities worth? • Quality of Audit Firm • Reports must be accepted by user organizations • Get it right the first time • Questions to ask…

18. Framework Overlap • Many of the regulations and frameworks overlap • How to demonstrate compliance • One audit, multiple reports

19. Framework Overlap

20. Framework Drilldown • Risk management is a common theme within many information security standards • HIPAA - 164.308(a)(1)(ii)(A) • FISMA - §3544(a)(b)(1) • ISO 27001 – Clause 4.2.1 • SOC 2 – 3.1 within the Security, Availability, Processing Integrity, and Confidentiality Trust Services Principles • PCI – 12.2.1

21. Sample Risk Assessment

22. Tips for Successfully Passing an Audit • Have one or more established, positive, goals • Establish expectations with training • Evaluate your strengths, assess your weaknesses, identify your exposures • Review prior audit results • Practice, practice, practice

23. Tips for Successfully Passing an Audit – Cont. • Copy when you can • Be ready to respond as issues arise • Coaching staff • Document and train on processes • Have fun!

24. Thank You Newel Linford and Robert Pierce newel@linfordco.com rob@linfordco.com www.linfordco.com linford&collp