Mass 201 CMR 17: a Survival Guide for the Anxious
Security pros are reasonably confident most companies will survive this latest compliance push unscathed. And why not? Many of the provisions are basic best practices other government regulations and industry standards have required for years. That's not to say this is a piece of cake.
Thu, July 23, 2009
CSO — David Escalante has as much cause as any IT security practitioner to be nervous about Mass 201 CMR 17, the tough Massachusetts data protection requirements organizations must comply with by Jan. 1, 2010.
As director of computer policy and security at Boston College, he oversees the security of a computer network accessed daily by some 10,000 students who storm the campus after Labor Day with myriad personal computing devices loaded with any number of sinister programs. (See Six Essential Steps to Secure Academia.)
Yet he was cool and calm during a CSO Executive Seminar on Mass 201 CMR 17.00 Thursday, as were the other legal and security experts on hand.
The reason -- they're reasonably confident most companies will survive this latest compliance push unscathed. And why not? Many of the provisions are basic best practices other government regulations and industry standards have required for years.
That's not to say this is a piece of cake. Compliance doesn't always ensure security. The Hannaford supermarket chain learned this the hard way after suffering a data breach despite all the PCI DSS compliance work it had done.
And so the seminar speakers tried to give attendees a clearer picture of what's needed. Among the advice -- have a plan on the shelf that outlines who will do what in the event of a data breach, and invest time and money in awareness campaigns that won't put employees to sleep.
"Much of this you should be doing anyway," Escalante said. "If you follow best practices such as those outlined in things like Cobit and ISO 17799, you WILL be okay."
High anxietyDespite the calmness described above, few challenges have been more worrisome to IT security practitioners than meeting all the requirements of Mass 201 CMR 17.
With a Jan. 1 compliance deadline, companies are scrambling to make sense of just what exactly needs doing in the next five months, and, where the security controls they installed for previous regulatory requirements may or may not fit in.
(See also: Mass. 201 CMR 17: The Darkness and the Light)
Issued last September, the regulations require that businesses encrypt documents sent over the Internet or saved on laptops or flash drives, encrypt wirelessly transmitted data, and deploy up-to-date firewalls to create "an electronic gatekeeper" between the data and the outside world that only allows authorized users to access or transmit data.
Because of the ongoing economic crisis and concern from companies that need more time to digest the provisions, the compliance deadline has been moved twice. First it was moved from Jan. 1, 2009 to May 1, 2009. Companies now have until January 2010 to have all their security ducks in a row -- see Mass. Data Protection Law Amended, Deadline Extended (Again).
