At Onspring, figuring out the complexities of GDPR has been a complicated task, but helping customers through the wilderness of the law has been a challenge we relish. I talked with of few of our associates who dealt with intricacies of the law itself and found out just how much Onspring was able to help with the overall effects many organizations faced when first dealing with it.
Enacted on June 28, 2019, and effective January 1, 2020, the CCPA grants California consumers additional rights with respect to their personal information and requires certain entities that conduct business in California to take steps to track, grant access to, manage, and report on this data.
Whether it be ISO27001 or NIST, ensuring that you are employing the proper policies and frameworks is essential. Not doing a regular assessment could cause major, unsustainable damage to your business. Having the right platform to help you organize all of the policies, risks and other pertinent information (trust me, there’s a lot) is essential.
One of the main aspects of the HIPAA law is that it forces healthcare practices and professionals to keep and secure PHI (protected health information) from data breaches and other possible complications and problems. This makes HIPAA and other regulations associated with it something that’s extremely important to the risk and compliance field, especially when dealing with highly sensitive health data.
To help set up a strong, foundational platform that will produce desired results, A Roadmap to Control examines the different pieces of control that are necessary when mapping out a program and will help you set a course to a comprehensive compliance program to move from an overarching concept to a manageable system of controls.
The North American Electric Reliability Corporation (NERC) is certainly not new, but the approach NERC is taking in regards to its requirements has transformed over the past four years. This change was born out of the recognition that all Registered Entities have limited resources for compliance activities, and that not all issues and findings identified represent the same level of risk to the bulk power system.
Each of the primary groups impacted by SOX—Management, Public Accountants and Internal Auditors—has more clearly defined what role they play in the overall process, and this definition has been carefully and thoughtfully refined over time. And while we have reached a much more structured and stable point in the SOX lifecycle, it’s never a bad idea to revisit and refresh our understanding of why this structure works. A big reason why we find ourselves in this more predictable state is that all involved parties have a much better understanding of their specific role in the process.
Is there ever a slow week in compliance-related news? Not that we can remember. It’s tough to keep up with the latest developments in legal and regulatory requirements, evolving industry standards and internal best practices for compliance professionals. Onspring is here to help. We’ve gathered articles, opinions and insights that will bring you up to speed.
I believe you’d be surprised at the number of organizations that do not have a fully structured approach to evaluating the effectiveness of their system of controls. Whether their approach is not formally defined and communicated, inconsistently applied and/or inefficiently managed and monitored, they are at risk of not fully understanding whether their controls are meeting their stated objectives or worse, being completely caught off guard by a critical control failure that could lead to much more serious issues. To that end, we offer the following considerations as you evaluate the effectiveness of your control testing program.
While the concept of reporting seems to be pretty straightforward, the term “report” can have a variety of meanings, so I’m always careful to validate my understanding so I don’t veer off in some unwanted direction. After all, reporting capabilities often represents the organization’s A-1 deal breaker requirement.
Organizations stand to benefit from building a standardized control library. Even the simplest data points you capture can become part of a very compelling story about how well (or poorly) your organization is meeting its objectives. And organizing this library in a systematic and structured way allows you to keep that critical knowledge at your fingertips and answer compelling questions at a moment’s notice.
Common supports remain in place, even as regulations and best practices evolve. Remember this as you stand at the metaphorical “ice cream counter of compliance.” The sheer variety and complexity of requirements can be overwhelming, but the core people, processes and technologies you engage to understand and address those requirements remains largely the same.