Category: Regulations – SOX

Protecting Financial and Insurance Data: Key Compliance Mandates to Know

September 20, 2024 at 8:30 am by Amanda Canale

Every day, financial institutions face threats of data breaches, making cybersecurity a critical aspect of their operations. As technology evolves, so do the malicious tactics used by cybercriminals to exploit vulnerabilities in the financial sector. This is where compliance regulations come into play. These regulations are designed to protect sensitive financial information, mitigate cyber risks, and maintain the integrity of the financial system.

At the heart of financial compliance is the responsibility to safeguard consumer data and financial information. Financial institutions, from banks to insurance firms, collect and process vast amounts of personal and financial data, that if breached, can be a major liability to both organizations and individuals alike. This data can include everything from credit card numbers and social security details to transaction histories and insurance policies. Given the sensitivity of this information, these regulatory frameworks were developed to ensure its constant protection. 

Here’s an overview of some of the critical regulations shaping the world of finance compliance.

credit card finance isa

Sarbanes-Oxley Act (SOX)

The Sarbanes-Oxley Act (SOX), passed in 2002, was established to protect investors by improving the accuracy and reliability of corporate financial disclosures and reporting. Although the act focuses on financial transparency and corporate governance, SOX compliance is mandatory for all public companies.

A crucial part of SOX compliance is record retention. Financial and insurance companies must keep a wide range of documents, from financial statements and accounting records to emails and client information, for a specific timeframe. While SOX doesn’t dictate exactly how records should be destroyed, it stresses the importance of maintaining accurate, unaltered data, for specific lengths of time.

When it’s time to securely dispose of expired records, organizations should, at a minimum, implement a risk management  and destruction plan that falls in compliance with NIST 800-88 data disposal standards to ensure sensitive information is destroyed responsibly and in line with SOX requirements.

 Fair and Accurate Credit Transactions Act (FACTA)

The Fair and Accurate Credit Transactions Act (FACTA), enacted in 2003, is a crucial piece of legislation aimed at enhancing the accuracy, privacy, and security of consumer information. FACTA as it stands today, amended the Fair Credit Reporting Act (FCRA) and was introduced to address growing concerns about identity theft and consumer credit reporting practices. 

At its core, FACTA provides consumers with greater access to their credit reports and includes measures to assist with fraud prevention. One of its most notable impacts is allowing consumers to request a free annual credit report from each of the major credit reporting agencies, ensuring individuals can monitor their credit history and identify potential discrepancies. 

While FACTA doesn’t mandate just one specific method for disposing of consumer report information, it allows some flexibility, enabling organizations to choose their disposal method based on the sensitivity of the data and the associated costs. It is, however, recommended to follow NIST 800-88 data disposal standards for secure and compliant destruction of consumer reports.

credit-card-data

General Data Protection Regulation (GDPR)

The European Union’s General Data Protection Regulation (GDPR) has had a profound impact on global financial institutions and their operations. GDPR focuses on data privacy within the European Union and was designed to protect the personal data of the region’s citizens from cyberattacks. Organizations that process data from EU citizens must comply with GDPR, meaning organizations with EU customers, visitors, branches, those offering goods or services in the region, and even cloud computing companies. Essentially, regardless of where the organization is located, if the data of EU residents is involved, compliance with GDPR standards and regulations is non-negotiable. 

The mandate also grants individuals the freedom to have a say in what happens with their data, giving them the right to access, correct, and destroy their data. Organizations must also implement enforce stringent security measures to protect that information from unauthorized access or breaches and maintain transparency about how data is used.  

The GDPR checklist for data controllers is a phenomenal tool designed to help keep organizations on the road towards data security compliance. More information on GDPR’s data destruction best practices can be found here.

Gramm-Leach-Bliley Act (GLBA)

The Gramm-Leach-Bliley Act (GLBA), passed in 1999, focuses on the protection of non-public personal information (NPI) in the financial services sector. The GLBA primarily governs how financial institutions handle the privacy of sensitive customer data and sets strict regulations on how that information can be collected, stored, and shared. By ensuring that businesses adopt responsible data management practices, the GLBA aims to protect consumers from financial and insurance fraud. Financial institutions, such as banks, credit unions, and insurance companies, are required to provide clear and transparent privacy policies, informing customers about the ways their information may be used or shared with third parties.

A key component of the GLBA is the Financial Privacy Rule, which outlines specific guidelines that financial institutions must follow when collecting personal data. This rule requires institutions to give customers the option to “opt-out” of having their information shared with non-affiliated third parties, thereby empowering consumers to have more control over their personal data. 

In 2021, responding to the rise in data breaches, the Federal Trade Commission strengthened data security protocols under GLBA with an updated Safeguards Rule. This rule extends to all non-bank financial institutions, including mortgage companies, car dealers, and insurance companies, ensuring customer financial data is securely protected.

One of the key requirements of the Safeguards Rule is that these institutions must implement a secure disposal policy for customer information within two years of its last use—unless retention is legally or operationally necessary. Although the rule doesn’t list a specific disposal method, following NIST 800-88 data disposal standards is widely regarded as a best practice.

identity-theft

Payment Card Industry Data Security Standard (PCI DSS)

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards established by major credit card companies to protect payment card information and ensure the secure handling of credit and debit card transactions. Established in 2004 by major credit card companies, including Visa, MasterCard, and American Express, PCI DSS applies to any organization that processes, stores, or transmits payment card information. The goal of these standards is to minimize the risk of breaches, fraud, and identity theft, and quicken data breach response times by enforcing strict security practices across all entities involved in the payment process. 

PCI Requirement 3.1 specifically mandates that organizations securely dispose of cardholder data that is no longer needed, with the principle, “if you don’t need it, don’t store it.” Retaining unnecessary data creates a significant liability, and only legally required data should be kept. This applies to any organization involved in processing, storing, or transmitting payment card information—from retail businesses and payment processors to banks and card manufacturers.

While PCI DSS does not prescribe a specific method for data destruction, the consequences of non-compliance are severe. To mitigate risks, organizations should have clear policies in place for securely destroying all unnecessary data, including both hardcopy documents and electronic media like hard drives, servers, and storage devices.

For PCI DSS compliance, it’s recommended to follow NIST 800-88 data disposal standards to ensure secure and thorough destruction of cardholder data.

Conclusion

Understanding and complying with these mandates is crucial for financial institutions to navigate the complex regulatory environment. By implementing robust internal controls, risk management protocols, and staying informed about regulatory changes, organizations can uphold the principles of transparency, security, and trust that are fundamental to the industry.

Sarbanes-Oxley and Data Destruction: How to Best Comply 

March 11, 2019 at 4:00 pm by Paul Falcone

If you operate or manage a public company or a non-public company with publicly traded debt securities, you’ve certainly heard of the Sarbanes-Oxley (SOX) Act of 2002. This law is also aptly referred to as the “Corporate and Auditing Accountability and Responsibility Act” or the “Public Company Accounting Reform and Investor Protection Act”. 

The SOX Act was enacted by the US federal government to address the standards by which the management and board of directors of any domestic public company handle the financial information and financial reporting of the organization. The SOX Act also extends to public accounting firms as well as to other companies that do business with publicly traded companies, even if said company is not a publicly traded entity. 

The SOX Act aims to strengthen the audit committees of these US-based public companies as well as hold the management and officers liable to the accuracy of the financial statements for the business. In so doing, this Act works to prevent securities and investment fraud by the organizations covered under SOX.  

SOX Act

General Regulations of the SOX Act 

The Sarbanes-Oxley Act is made up of two main clauses. According to Section 404 under the Management Assessment of Internal Controls, Clause A requires these publicly traded companies to create a commission on behalf of the company that develops and enforces rules for maintaining an internal control report for each annual financial report by section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m or 78o(d)). This internal control report must include information and policies on how management establishes and maintains an adequate structure for internal control as it pertains to the financial reporting of the company. Clause A also requires the commission to write up an annual report on the effectiveness of the internal control policies and financial reporting procedures at the end of each fiscal year.  

Clause B expands on the regulations for the internal control evaluation and reporting, adding in required responsibility of the commission or registered public accounting firm issuing the audit report to accurately prepare the audit as stated in Clause A. That is, said commission or public accounting firm is also held liable to the reported information claimed about the management of the stated financial information in the internal control report.  

Maintaining compliance with the SOX Act therefore means ensuring all financial information and reporting that pertains to the organization is kept secure and protected from unauthorized personnel and possible theft.  

SOX data destruction

 Data Security Best Practices 

When it comes to financial data end-of-life cycles, it’s therefore extremely important for companies covered under the SOX Act to appropriately destroy their data so that the information contained cannot be accessed or reconstructed. In so doing, the company further maintains SOX compliance and ensures fraud prevention of its financial reporting, even as the data has been slated for decommission.  

This means not only proper disposal of the data, but also of the hard drives or electronic storage media housing the data. Organizations covered under the SOX Act must use the proper channels and procedures for data destruction. Such methods include overwriting non-sensitive information with software or hardware to clear the data (not recommended due to the recoverability of data from “erased” drives),  degaussing the media  and rendering the magnetic field permanently unusable, or  destroying the media by disintegration, pulverization, shredding, melting, or incineration. 

Rather than work with a third party off-site to destroy the data and drives, it’s recommended that the organization create a designated, private space within its premises for the data destruction and drive disposal. The organization should also consider limiting access to the data and drive destruction procedures within the private space to only a select number of authorized personnel. Enforcing restricted access within a private, on-site space further protects and secures the data from theft and misuse.  

Final Considerations for Data Destruction 

Working with a vendor like SEM that provides on-site data destruction machinery is essential to maintaining control and security over your financial data. Allowing your data to leave your premises by a third party can be extremely risky because they are not liable for your data security. For instance, imagine if that third party you hired did not actually destroy your drives but instead sold your financial data to an outside party. 

It’s also a good idea to check that the vendor you are working with has machinery that adheres to NSA and NIST 800-88 guidelines for data destruction and SOX Act compliance.  

The Importance of the NIST 800-88 Standard for Media Sanitization in Secure Data Destruction

November 21, 2018 at 4:00 pm by Heidi White

pii-securityTrends in data storage are changing at an exponential rate. The past few years alone have seen the progression of data storage from large servers with magnetic media to cloud-based infrastructure with increasingly dense solid state media. Along with every technological advancement in data storage has come the inexorable advancement of data theft. As a result, the scope and level of responsibility for protecting sensitive and Personally Identifiable Information (PII) has expanded to include not only the originators of data, but also all of the intermediaries involved in the processing, storage, and disposal of data. To address these critical issues and to protect organizations and citizens of the United States, the Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) has developed NIST 800-88 “Guidelines for Media Sanitization” to promote information system security for all other applications outside of national security, including industry, government, academia, and healthcare. NIST 800-88 has become the predominant standard for the US Government, being referenced in all federal data privacy laws, and has now been overwhelmingly adopted by the private sector as well.

NIST 800-88 assumes that organizations have already identified the appropriate information categories, confidentiality impact levels, and location of the information at the earliest phase of the system life cycle as per NIST SP 800-64 “Security Considerations in the Systems Development Life Cycle.” Failing to initially identify security considerations as part of the data lifecycle opens up the strong potential that the organization will fail to appropriately maintain control of and protect some media that contains sensitive information.

Confidentiality and Media Types

data-theftConfidentiality is defined by the Title 44 US Code as “preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.” FIPS 199 — NIST’s Federal Information Processing Standard Publication 199, Standards for Security Categorization of Federal Information and Information Systems — adds that “a loss of confidentiality is the unauthorized disclosure of information.” Bearing these definitions in mind, organizations must establish policies and procedures to safeguard data on used media. Common methodologies of illicit data recovery include basic acquisition of clumsily sanitized media either through third party sale or old-fashioned dumpster diving, or the more sophisticated laboratory reconstruction of inadequately sanitized media.

data-securityCurrently, two types of basic media exist: hard copy and electronic. Commonly associated with paper printouts, hard copy actually encompasses a lot more. In fact, all of the materials used in the printing of all types of media, including printer and fax ribbons for paper and foils and ribbons for credit cards, are considered hard copy. Electronic media consists of any devices containing bits and bytes, including but not limited to rotational and solid state hard drives, RAM, boards, thumb drives, cell phones, tablets, office equipment including printer and fax drives, server devices, flash memory, and disks. It is expected that, considering the rate at which technology is progressing, additional media types will be developed. NIST 800-88 was developed in such a way that sanitization and disposal best practices pertain to the information housed on media rather than the media itself, allowing the guideline to more successfully stay current with future innovations.

Media Sanitization – Methodologies, Responsibilities, and Challenges

Three methodologies of media sanitization are defined by NIST 800-88 as follows:

  • Clear applies logical techniques to sanitize data in all user-addressable storage locations for protection against simple non-invasive data recovery techniques; typically applied through the standard Read and Write commands to the storage device, such as by rewriting with a new value or using a menu option to reset the device to the factory state (where rewriting is not supported).
  • Purge applies physical or logical techniques that render Target Data recovery infeasible using state of the art laboratory
  • Destroy renders Target Data recovery infeasible using state of the art laboratory techniques and results in the subsequent inability to use the media for storage of

Clear

One of the most commonly used clearing methodologies for data sanitization on magnetic media has traditionally been overwriting using dedicated sanitize commands. Note that basic read/write overwriting is never recommended as it does not address all blocks on the media. Drawbacks to overwriting using sanitize commands are two-fold: 1) it is only effective for magnetic media, not solid state or flash, and 2) this methodology is wide open to operator error and theft, as well as undetected failure.

Purge

SEM’s high security degausser can be used to purge data

A common form of purging used for magnetic media sanitization is electromagnetic degaussing, whereby a dedicated degaussing device produces a build-up of electrical energy to create a magnetic field that removes the data from the device when discharged. Degaussing has long been an acceptable form of media sanitization for top secret government information when used in tandem with a hard drive destruction device such as a crusher or shredder. Degaussing alone poses the same concerns as overwriting in that operator error or deceit remains a possibility. In addition, the strength of the degausser is critical when eliminating sensitive information from magnetic media. Typically, degaussers evaluated and listed by the National Security Agency (NSA) are considered the golden standard.

Destroy

While clearing and purging provide adequate media sanitization involving less sensitive data, destroying is the most effective and permanent solution for secure data applications. Organizations should take into account the classification of information and the medium on which it was recorded, as well as the risk to confidentiality. As the internet continues to expand and the switch from physical to digital document-keeping becomes the industry standard, more and more data holds PII information such as financials, health records, and other personal information such as that collected for databases or human resources. As a result, security-focused organizations are becoming more cognizant of the fact that comprehensive data sanitization — including destruction — must become a top priority.

ssd-2mm
SEM disintegrators shred particles to a nominal 2mm size

Industry-tested and accepted methodologies of secure data destruction include crushing, shredding, and disintegration, but even these secure end-of-life solutions require thoughtful security considerations. For example, shredding rotational hard drives to a 19mm x random shred size provides exceptional security for sensitive information. However, a 19mm shred size would not even be an option for solid state media, which store vast amounts of data on very small chips. Instead, sensitive solid state media should be shredded to a maximum size of only 9.5mm x random, while best practices for the destruction of highly sensitive or secret information is to disintegrate the media to a nominal shred size of 2mm2. In addition, some destruction devices such as disintegrators are capable of destroying not only electronic media, but also hard copy media such as printer ribbons and employee ID cards, providing a cost-effective sanitization method for all of an organization’s media.

Responsibilities and Verification

IT security officerWhile NIST 800-88 has become the industry standard for secure data sanitization, the guidelines do not provide definitive policies for organizations. Rather, NIST 800-88 leaves the onus of appropriate data sanitization to organizations’ responsible parties including chief information officers, information security officers, system security managers, as well as engineers and system architects who are involved in the acquisition, installation, and disposal of storage media. NIST 800-88 provides a decision flow that asks key stakeholders questions regarding security categorization, media chain of custody including internal and external considerations, and potential for reuse.

Regardless of the sanitization method chosen, verification is considered an essential step in the process of maintaining confidentiality. It should be noted that verification applies not only to equipment and sanitization results, but also to personnel competencies. Sanitization equipment verification includes testing and certification of the equipment, such as NSA evaluation and listing, as well as strict adherence to scheduled maintenance. Organizations should fully train personnel responsible for sanitization processes and continue to train with personnel turnover. Lastly, the sanitization result itself must be verified through third party testing if the media is going to be reused. When media is destroyed, no such verification is necessary, as the pulverized material itself is verification enough. Because third party testing can be impractical, time consuming, and costly, many organizations choose to destroy media to ensure full sanitization of data and in doing so, to greatly mitigate risk.

Conclusion

NIST-800-88NIST 800-88 was developed in an effort to protect the privacy and interests of organizations and individuals in the United States. Adopted by nearly all federal and private organizations, NIST 800-88 provides an outline of appropriate procedures for secure data sanitization that both protects PII and confidential information while reducing organizational liability. Determining proper policies is realized by fully understanding the guidelines, following the sanitization and disposition decision flow, implementing data sanitization best practices, and engaging in ongoing training and scheduled maintenance. Because NIST 800-88 guidelines do not provide a definitive one-size-fits-all solution and are admittedly extensive, working with a knowledgeable data sanitization partner is key to a successful sanitization policy.