Does your company collect personal data?
EU's GDPR applies!
Calculating the cost of GDPR compliance
The EU General Data Protection Regulation (GDPR) is unique in the field of compliance standards for its establishment of financial penalties for the loss or mismanagement of personal data of EU citizens. And those fines are higher and more likely to be assessed than any existing standard. Any company that does business with an EU citizen (controls or processes their personal data) is subject to fines calculated on three points:
- How much personal data of EU citizens has been mismanaged or lost
- What steps had been taken prior to the incident to avoid loss
- What steps were taken after a loss
If you handle little or no personal data of EU Citizens, have well maintained, well documented and standard security processes in place and you take compliance actions specified in the GDPR after discovering any data loss, then it will have little impact on your company.
Vulnerability Assessment, a pillar of the EU GDPR
VA is a key means of documenting that your security is up to snuff. The EU GDPR does not specify exact security requirements, but makes it clear that normal and usual security actions MUST be in place to be in compliance. VA as a security mainstay is in this category and scanning of infrastructure that collects, stores or transmits personal data is a must.
The EU GDPR compliance mandates that all organizations with access to Personally Identifiable Information of EU citizens take sufficient measures to ensure the security and privacy of their data. The GDPR will take effect on May 25, 2018 and it will run in parallel to other data protection directives. Compliance with SOX, HIPAA, ISO2700, etc. will help, but GDPR compliance has its own requirements, particularly regarding reporting. Wait a year to report a hack and you will pay a high price.
GDPR articles relating to Vulnerability Assessment
|GDPR Article||Vulnerability Assessment|
|Article 32 (page52) Security of processing "1. ..... shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: ......,(b)the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;||VA measures and manages risk, ensuring confidentiality, integrity and availability. When applied to processing systems, it can monitor systems against security policies, identify and track vulnerabilities and document corrective actions through log data.|
|(d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.||Vulnerability Assessment is the central technology for testing, assessing and evaluating the effectiveness of measures taken to harden network resources against attack.|
|Article 39 (page 56) Tasks of the data protection officer "1. The data protection officer shall have at least the following tasks: ... (b) to monitor compliance with this Regulation, ..."||VA provides the reports from which to validate that appropriate security measures have been implemented and that action has been taken to mitigate vulnerabilities.|
|Article 57 (page 68) Tasks “… each supervisory authority shall on its
territory: ... (h) conduct investigations on the application of this Regulation…
|Vulnerability Assessment reports provide details on asset inventory, identity and vulnerabilities. AVDS provides a history of assets activity in log events for detailed investigations.|
|Article 59 (page 70) Activity reports "Each supervisory, authority shall draw up an annual report on its activities, which may include a list of types of infringement notified and types of measures taken in accordance with Article 58(2). ..."||The results from VA scans can be used to contribute to an annual report. Contributions would include validation of compliance.|
Beyond Security is ready to help our customers meet the risk identification, testing and evaluation aspects of the provisions within EU GDPR that affect Data Controllers and Data Processors. Moreover, in addition to specific clauses in article 32, Beyond Security provides capabilities with assessing host discovery, preventive vulnerability management and EU GDPR compliance.
Using VA to prepare for GDPR compliance
In preparing to meet EU GDPR compliance requirements, organizations must observe a minimum set of security controls to avoid both penalties and loss of customer trust. Those related to and delivered by VA are:
- Visibility of your IT environment which uncovers blind spots or shadow IT
- Continuous and automatic updates combined with full remediation capabilities
- Asset criticality rankings
- Reporting with full support for GDPR compliance
- Integration with your SIEM, ticketing system and other business-critical data
To attain EU GDPR compliance readiness, you need complete visibility into your IT assets through blindspot detection and an assurance that your applications are hardened against exploits and misuse. Beyond Security offers a complete product portfolio to help you address both known and unknown vulnerabilities hidden in your applications, assets and networks to meet any compliance challenge.
For more info on EU GDPR compliance, call, email or fill out the form on this page.