Meeting Regulatory Compliance

Highly-regulated industries (e.g. publicly-traded organizations, health care providers, financial institutions, legal firms, etc.) are often legally required to meet specific regulations regarding the operation of their businesses, primarily the storage, retention, security and data management practices for critical data. It is also extremely important for all businesses outsourcing business-critical data, applications, and systems to remain as secure as possible. Achieving industry compliance is very expensive and time consuming, so often the most affordable and effective option to achieve regulatory compliance and attain a level of security required for your business or industry is to choose a certified and compliant Cloud Service Provider (CSP) when outsourcing your IT systems, applications, data, and IT infrastructure. Cloud Service Providers outsourcing IT services to highly-regulated industries must follow the same strict IT governance policies of secure storage and retention of data.

Regulatory compliance, internal auditing, and certification are extremely important factors to evaluate when choosing a Cloud Service Provider. Because you place your most critical applications and data in the charge of a third-party service provider, you must be able to trust their systems and operations.

A breach of privacy or security often leads to costly and very time-consuming Public Relations exercises. Failure to comply with industry-accepted IT compliance regulations and best practices stipulates costly fees. More importantly, a breach often results in the loss of reputation and goodwill, a priceless asset that is often impossible to replace, and could ultimately lead to the loss of your business. Perform a thorough due diligence examination of desired service providers to ensure they are certified hosting service providers.

Certification and Compliance

There are two types of industry leading certification and compliance for advanced Cloud Service Providers:

CICA 5970 certification defines the professional standards, including requirements regarding compliance, security and access, backup and recovery, computer operations and facility infrastructure for service providers that manage customer data. This is a Canadian standard and is set and overseen by the Canadian Institute of Chartered Accountants (equivalent to SAS 70, the USA version and similar to ISO 27001).

There are two levels of compliance of the CICA 5970 certification:

• Type A / I – necessary before Type B can be awarded. This certification signifies that a business has prepared the controls and related documents to prove that it is compliant with the CICA 5970 regulations.
• Type B / II – this level is time-tested; once Type A certification is reached, the business must prove that its practices comply with the regulations. After one year, the practices are audited to determine that the controls/system are time-tested compliant and then certification is awarded.

PCI DSS (Payment Card Industry Data Security Standard) compliance requires the observance of PCI DSS policies and procedures concerning credit card account data security. All organizations that accept, store, process or transmit credit card details must be PCI compliant. This multidimensional security standard includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures to ensure a controlled and secure environment for processing the sensitive information. PCI DSS compliance is a requirement for all business now if they process credit cards.

What is SAS 70? What is ISO 27001?

SAS 70 is a statement on auditing standards (used by an independent auditor to evaluate a service provider’s controls and generate a report/determine certification eligibility) of a service provider’s data security controls, defined by AICPA (the American Institute of Certified Public Accountants. SAS 70 is the most commonly used standard in the USA.

ISO 27001 is a specification for an information security management system (ISMS). An ISMS is a framework of policies and procedures that includes all legal, physical and a technical control involved in an organization’s information risk management processes, and can be used to measure a service provider’s data security controls. This standard is most commonly used in European countries

Benefits of a Certified Cloud Service Provider

Partner with a certified and compliant Cloud Service Provider and enjoy the benefits of Cloud services provided through a guaranteed, highly-secured, fully certified/compliant world-class datacenter.

Achieve Compliance Faster and More Cost-Effectively.  Leverage the compliancy and certification of a proven and trusted Cloud Service Provider instead of having to build and maintain your own datacenter and undertake a very time-consuming and expensive process to achieve certification and compliancy.

Reduce Liability Due to Security Breach. Partnering with a certified Cloud Service Provider will reduce and mitigate the risks around security breach and liability.

Dramatically Improve Protection of Company Data and Information.  Choose a trusted, proven, certified and compliant Cloud Service Provider with a highly-secured, world-class datacenter for the best protection for your business-critical information.

Independently Certified and Audited.  You can trust in a compliant and certified Cloud Service Provider; all Cloud Service Providers are audited by an independent auditor to ensure full compliancy.

Performing your thorough due diligence when selecting a Cloud Computing service provider that meets industry regulatory compliance is of the utmost importance and should not be overlooked. Don’t let your critical systems and data be compromised by a service provider that cannot deliver the security specifications your business legally requires! Do business with trusted and compliant Cloud Service Provider with a world-class datacenter and operational expertise that are both PCI DSS and CICA 5970 compliant and certified.