Security

What Startup Company Leaders Must Know About Cybersecurity Compliance

It’s a prerequisite for keeping investors happy and criminals frustrated.

Don Lupejkis is a Solution Architect with CDW’s InfoSec Security team. His passion is helping organizations on their journey to a more secure environment.

It’s common for startup companies to overlook cybersecurity and privacy compliance. After all, life in a startup is a high-wire act, consumed with building products, acquiring new customers, hiring talent, and finding new investors. It’s no surprise when compliance is put on the back burner. Heck, it’s almost forgivable.

Almost, but not quite.

Because here’s the thing: Security compliance isn’t just about following bureaucratic rules; it also makes businesses safer. And the stakes could not be higher. A security breach can wreck a company’s reputation and lead to a loss of trust among its customers, partners, and investors, to say nothing of potential lawsuits and fines that may result. It very well could put a startup out of business.

Moreover, noncompliant startups face a risk beyond a potential breach or regulatory punishment. Startups are dependent on investor dollars, and investors tend to balk at giving money to companies that aren’t careful about their security.

So, let’s look at what compliance is all about for startup businesses, and what they need to do to get there.

Click the banner to gain expert advice on improving your zero-trust security model.

What Does Cybersecurity and Privacy Compliance Mean for Startups?

At its core, cybersecurity compliance involves adherence to standards and regulatory requirements set forth by an agency, law or other authority. Organizations must achieve compliance by establishing risk-based controls that protect the confidentiality, integrity, and availability of information.

Some regulations can apply to virtually all businesses; others may depend on an organization’s industry or specific situation. The most widely applied security and privacy regulations and standards are the National Institute of Standards and Technology’s Privacy and Cybersecurity frameworks (NIST), the General Data Protection Regulation (GDPR) and the Payment Card Industry Data Security Standard (PCI-DSS).

Smart businesses strive to comply with at least one of these cybersecurity frameworks, and if there’s one that organizations should prioritize it’s the tools provided by the National Institute of Standards and Technology. Far from a burden, these frameworks are a gift to businesses, providing a blueprint they can follow to ensure they’ve taken every step realistically possible to ensure that their organization is secure.

The GDPR is another very important regulation. It’s a set of data privacy rules meant to grant individuals greater rights over how their information is collected, stored and used. Although promulgated by the European Union, it effectively applies to any organization that does business online, regardless of location. It’s best to become compliant with GDPR rather than to try to figure out whether you can get away with being noncompliant.

PCI-DSS is the third standard to know about. It was created and is required by credit card companies to reduce payment card fraud. In general, any business that accepts credit cards must comply with it or risk going unreimbursed for any fraud that occurs while using noncompliant technology.

Beyond these three, most security regulations tend to be industry specific. Healthcare organizations, for example, must comply with the Health Insurance Portability and Accountability Act. Financial services organizations must follow Sarbanes-Oxley. Companies that do business with the U.S. Department of Defense, meanwhile, may have to participate in the Cybersecurity Maturity Model Certification program. Many startups will find that their investors, if not their customers or business partners, require such compliance.

What Mistakes Do Startups Make in Their Compliance Programs?

I’ve never met a business owner or startup entrepreneur who didn’t care about breaches by cybercriminals. All of them are aware of the threats and want their businesses to be as safe as possible.

So why is good compliance so elusive? One reason is that businesses often think they can do it alone. Perhaps they have an IT leader on staff whom the CEO trusts to manage compliance, or perhaps the CEO has a background in technology. They may think they can achieve compliance by simply purchasing the right cybersecurity solution.

EXPLORE: How financial institutions can maintain compliance as regulations evolve.

But effective compliance requires building a program that starts with assembling a multidisciplinary team of experts — both inside and outside of the business — from fields such as cybersecurity, business management and law. They will be responsible for risk analysis, policy development, control setting and monitoring.

The compliance program must also ensure that there’s a documented incident response plan in place so that when a breach does occur, as it almost certainly will, key parties within the business know whom to call and what to do.

It sounds daunting, and it is. No business can do all of that alone. The good news is that no business has to.

The best place to start is with a comprehensive security assessment. That may include a penetration test or any of several other kinds of assessments, followed by a detailed report that provides a path forward for businesses seeking to increase their compliance with regulations and security best practices.

This article is part of BizTech's AgilITy blog series.