C’s the Moment: Compliance, Cybersecurity, and Customers

HIPAA and GDPR and PCI…so many acronyms, so little time! You’ve likely run into myriad compliance regulations that can inform your customers’ cybersecurity posture. But you may also realize that compliance is about more than just cybersecurity, and likewise cybersecurity goes beyond compliance.

Compliance can be confusing, and growing industry standards have left many small businesses scrambling (and struggling) to keep up. As a provider, how can you help your customers with compliance needs while also moving the needle on their cybersecurity?

Why Comply?

Small businesses have a lot on their plate, so it can be difficult to justify investing in compliance. But increasingly, businesses don’t have much of a choice. Here are a few reasons to take compliance seriously:

• It’s good for business: Satisfying regulations creates new contract opportunities, while noncompliance can damage a company’s reputation
• It’s preventative: Compliance requirements often line up with cybersecurity best practices and readiness, and can even help encourage cyber insurance to pay out in the case of a breach
• It’s the law: Penalties for noncompliance can include fines, lawsuits, and lost contracts

Work with your customers to detail which requirements apply to them. A few common standards include:

• DFARS: The Defense Federal Acquisition Regulation Supplement  regulates DoD information
• GDPR: The General Data Protection Regulation protects personal data of European Union citizens
• HIPAA: The Health Insurance Portability and Accountability Act addresses privacy of health information
• PCI: Payment Card Industry standards protect payment card data
• SOX: The Sarbanes Oxley Act governs how businesses handle financial data

Meeting these and other regulations is an important part of doing business today. Even in lightly regulated industries, all businesses handle sensitive data, and following standards such as the NIST Framework is a good way to keep data protected.

How Can You Help Your Customers?

Compliance is on many business leaders’ minds, but they may not know where to start. While you might not have all the answers (i.e. you don’t need to be a compliancy expert), helping your customers plan for compliance and heightened security benefits everyone. Start with a few basic steps:

• Introduce the topic of compliance and help your customers determine which regulations apply to them.
• Discuss important points of compliance and how cybersecurity programs meet important security-related requirements.
• Determine any areas where they fall short and plan for improvements and/or remediation.

There are certainly many points of compliance that fall outside the realm of cybersecurity, but ultimately, your role is to help your customers navigate the world of technology – a world that increasingly involves compliance. If you and your customers are just getting started with compliance, there are a lot of great resources available that can help you get comfortable.

An Opportunity, Not an Obstacle

Compliance and cybersecurity go hand in hand, but true cybersecurity is about more than just checking the box. Encourage your customers to view compliance requirements not as an obstacle, but as an opportunity to shine and to protect themselves, especially with a strong cybersecurity posture. Regulations evolve, but so do threats and technology, and that’s where you add tremendous value to the conversation.