Compliance in Data Protection: Critical and Amorphous by Jay Livens

As an IT practitioner, you must ensure that your operations and processes are compliant with the appropriate government rules and regulations, but what exactly are the requirements? The answer varies by industry and environment; however, the policies are not as prescriptive as you might think. Jason Buffington from the Enterprise Strategy Group addresses these and other related question in a white paper entitled Regulatory Compliance and Operational Readiness: Complementary, but Never Synonymous (Disclosure: the paper was sponsored by Iron Mountain and available at the bottom of this post.) I wanted to spend some discussing a key takeaway from the paper.

As discussed above, there are multiple potential rules and regulations that can impact your company and Buffington summarizes a number of them including:

Section 11 of the Department of Homeland Security (DHS) Presidential Directive 20 (HSPD-20)

FEMA federal compliance directives covering the protection of vital records

Department of Defense Regulation DoD 5015.2-STD, specifically section C.2.2.9

HIPAA security section 2.3, rule 164.308 (a)(7)

Sarbanes-Oxley

You can read more about each of these in the paper, but there is an important commonality among all of them they state the business requirements that must be met such as requirements for disaster recovery or business continuity, but they are not prescriptive around what technologies must be used or avoided. Most of these regulations are not even prescriptive around retention policy. Hence, these rules are critical for your business and yet in some ways are amorphous. In my experience, companies often rely on their own internal judgment and knowledge to decide on the appropriate retention and protection strategies. Whatever policy is chosen, it is critical that the company formally document it and follow it religiously.

In summary, compliance is critical and IT needs to think carefully about how they store and protect their data to ensure that they meeting these requirements. At the same time, it is vital that company determine and appropriate policy, document it and follow it. A thoughtful approach will go a long way towards ensuring that compliance requirements are met. Finally, if you are looking for more detail about compliance issues and challenges, I encourage you to read ESG's whitepaper entitled Regulatory Compliance and Operational Readiness: Complementary, but Never Synonymous .

LINK:	http://blogs.ironmountain.com/2013/service-lines/data-backup-and-recov...
	See more stories from ironmountain

Most recent headlines