Navigating Compliance Requirements DCM 6 2 Regs and

Navigating Compliance Requirements DCM 6. 2 Regs and Codes linford&co llp

Navigating Compliance Requirements Data centers may choose to comply with many different rules and regulations such as, HIPAA, SSAE 16 (f. SAS 70), ISO, LEED, etc. We will break down the requirements and discuss where overlaps exist, how to leverage work between audits, and how to minimize audit impact.

Myriad of Regulations, Frameworks and Standards HIPAA SSAE 16 / SOC 1 PCI DSS FISMA ISO 27001 SOC 2, SOC 3 LEED

HIPAA • Health Insurance Portability and Accountability Act of 1996 • Privacy rule • Security rule – Three types of safeguards • Administrative • Physical • Technical • Required vs. addressable specifications • Why would a data center choose to be HIPAA compliant? • House e. PHI for clients

HIPAA Continued • How to demonstrate compliance • No HIPAA “certification” • Self audit • Independent audit • Cost of compliance • Resource to implement required policies and procedures and perform self assessment • Independent audit – 10 K to 100 K – depending on size and complexity • Cost of breach

FISMA • Federal Information Security Management Act of 2002 • Requirements • • Categorize information systems according to risk level (FIPS 199) Security controls Risk management System security plan • Why would a data center need to be compliant with FISMA? • House federal agency clients or contractors to federal agencies

FISMA Continued • How to demonstrate compliance • No FISMA “certification” • Independent audit • Cost of compliance • Resource to implement required policies and procedures, perform risk assessment, implement controls to remediate gaps • Independent audit – 20 K to 100 K – depending on size and complexity

ISO 27001: 2005 • Information security standards published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in 2005 • Requirements • Specifies a security management system • Required Every three years • Why might a data center choose to be ISO certified? • Data center is located outside of the United States • Data center does business with European clients

ISO 27001: 2005 Continued • How to demonstrate compliance • Certification by an ISO Registrar • Cost of compliance • Readiness assessment and consultations necessary • Separate ISO Registrar necessary • 50 K to 100 K+ Every Triennial

Payment Card Industry Data Security Standard – (PCI DSS) • Created by credit card companies to protect cardholder data • Requirements • 12 PCI DSS requirements • Service dependent • Why might a data center choose to be PCI certified? • Have credit card merchants or PSPs for clients • Client requirements

PCI DSS Continued • How to demonstrate compliance • Self assessment questionnaires (SAQ) • PCI Report of Compliance (ROC) • Listing on Credit Card Company’s Directory • Cost of compliance • Only QSAs Can Perform • 15 K to 100 K+ Per Annum

LEED System • LEED - Leadership in Energy and Environmental Design – Designed by the US Green Building Council in 1998. • Requirements • Voluntary • Energy efficiency evaluation • Four categories (Certified, Silver, Gold, and Platinum) • Why might a data center choose to be LEED certified? • Lower operating costs and increased asset value • Demonstrate energy efficiency to clients and prospects • Qualify for tax rebates, zoning allowances and other incentives

LEED Continued • How to demonstrate compliance • Project must satisfy LEED prerequisites and earn a minimum of 40 points on a 110 point LEED rating scale • Independent, third party verification that a company meets LEED • Cost of compliance • Implement LEED prerequisites to earn enough points to satisfy desired level of LEED certification – cost varies by project • Certifications fees vary by project size, the average cost is $2000

Service Organization Control Audits - SOC 1, 2, 3 • SOC 1 / SSAE 16 – (f. SAS 70) – Statement on Standards for Attestation Engagements • Internal Controls over Financial Reporting (ICFR) • SOC 2 and SOC 3 • Security, Availability, Processing Integrity, Confidentiality, or Privacy • Detailed vs High-Level • Why might a data center choose to obtain a SOC report? • Hosting General Ledger or ERP Systems • User Auditors’ Requirement

SOC 1, 2, 3 Continued • How to demonstrate compliance • Internal Controls In Place • Design Effectiveness • Operating Effectiveness • Cost of compliance • Only CPA Firms with Specialists Can Perform • 15 K – $1 M+ Per Annum

Ways to Demonstrate Compliance • Internal Testing • Independent Audits • Various External Audits

Cost of Compliance • Expensive • Value Judgment • How much is the customer or potential customer worth to company? • How much are lost or failed opportunities worth? • Quality of Audit Firm • Reports must be accepted by user organizations • Get it right the first time • Questions to ask…

Framework Overlap • Many of the regulations and frameworks overlap • How to demonstrate compliance • One audit, multiple reports

Framework Overlap HIPAA PCI FISMA SOC 2 Information Security Policy X X Logical Access X X Physical Access X X Encryption X X Employee Sanction X Risk Assessment X X Antivirus X X Logging X X X

Framework Drilldown • Risk management is a common theme within many information security standards • HIPAA - 164. 308(a)(1)(ii)(A) • FISMA - § 3544(a)(b)(1) • ISO 27001 – Clause 4. 2. 1 • SOC 2 – 3. 1 within the Security, Availability, Processing Integrity, and Confidentiality Trust Services Principles • PCI – 12. 2. 1

Sample Risk Assessment

Tips for Successfully Passing an Audit 1. Have one or more established, positive, goals 2. Establish expectations with training 3. Evaluate your strengths, assess your weaknesses, identify your exposures 4. Review prior audit results 5. Practice, practice

Tips for Successfully Passing an Audit – Cont. 6. Copy when you can 7. Be ready to respond as issues arise 8. Coaching staff 9. Document and train on processes 10. Have fun!

Thank You Newel Linford and Robert Pierce newel@linfordco. com rob@linfordco. com www. linfordco. com linford&co llp