Now that you have read The Ping: What is Compliance?, you are probably especially aware that your company might need to become compliant in one or more areas. Whether that be PCI, CJIS or something else, you might need to meet minimum regulations to keep your company safe.
For each area of concern with sensitive data, there are published guidelines to follow in order to achieve compliance. Reading and digesting the guidelines in whole can be a difficult task. There are decision making tools, technical requirement write-ups, security policies, and security procedures to pour through. So, without getting into the nitty gritty, we want to answer some of the frequently asked questions that come our way.
Criminal Justice Information Services (CJIS)
Criminal Justice Information Services, or CJIS, is a division of the FBI that provides criminal justice information needed to perform law enforcement duties. It “serve[s] as the focal point and central repository for criminal justice information services in the FBI.” – FBI. In Texas this information is disseminated via the DPS and includes details such as vehicle registration, criminal history, driver’s license, license plate, firearm, etc. Because this information is highly sensitive and needs to be protected, CJIS provides security compliance requirements and performs audits to ensure these requirements are being met. Below are just a few example requirements of the Security Policy…
- Security Awareness Training
- Perimeter Intrusion Detection
- Advanced Authentication
- Maintain Log History
- Change Management
- Device Encryption
Failing a single audit flags an agency as non-compliant. If compliance is not achieved, the agency can lose access to the information and tools needed to perform their duties.
What is compliance? Some of you might be acutely aware of this term, and others might have little to no idea. In broad terms, business compliance means following the rules required to secure your business and the people that interact with it. More specifically, compliance is aimed at information security. Business Compliance means you are complying with requirements by a credible organization or government department that promotes the security and protection of sensitive information.
What is “the cloud?” This is certainly a question you’ve asked or wondered. You may have received a few explanations too. When searching online, the first resulting definition used the words “Paradigm” and “Ubiquitous” … this does not clear things up for me. Let’s take care of that. If you’ve hear about “the cloud” you’ve likely heard the phrase “on premise” as well. If not, that’s ok. Defining both will help understanding each of them. So what exactly do those terms mean? Simple. Cloud vs On Premises is where your data is stored or resides. On premises data is housed locally in an environment that you (or your trusted IT vendor) maintain. Data is on your computers or servers and is easily accessible. Cloud is similar to its name. Data in the cloud resides offsite, somewhere outside of your home or office. Typically it is on a server, in a data center, miles away from you. Cloud data is accessible to you via a web browser or application.
If you have a big network I know this probably sounds like a lot to secure but its really manageable and the end result is you will have a better, more secure, less virus prone system. We’re here to help so if you have any questions about PCI Compliance or any other issue please feel free to email or call me at [email protected] or 512-832-6209.