How Information Security Audits Can Lead to New Opportunities in the Printing Industry

by Sarah Harvey / December 11th, 2018

What would it cost you if your printing business compromised client data because of a printing error? How would your organization be impacted if your printers were hacked? As service organizations and third-party vendors, organizations in the printing industry cater to a variety of organizations such as financial, government, or healthcare and are likely to interact with personally identifiable information (PII) on a regular basis. Because of this, it’s critical that printing organizations ensure that they are secure vendors, and they can do this by undergoing information security audits.

Common Frameworks for the Printing Industry

While there needs to be policies and procedures in place to govern product development, printing companies need to undergo regular information security audits to find and mitigate vulnerabilities found in their processes, assure their clients that they are secure, and get assurance by a third-party auditing firm that they are doing everything they’re supposed to be doing to protect PII. So, what types of information security audits would a printing organization need?

SOC 1: Do you print financial information such as billing statements or invoices? If so, a SOC 1 audit would be necessary for your organization.
SOC 2: How do you secure the information you’re printing? What internal controls do you have to protect the privacy of the information you’ve been given to print? Even if you aren’t printing PII, a third-party may still ask you to undergo a SOC 2 audit to verify that the internal controls you have in place won’t impact their security.
SOC for Cybersecurity: What risk management processes are in place at your organization? While a third-party might not ask you to pursue SOC for Cybersecurity compliance, your board of directors or management might want to conduct an internal assessment of your cybersecurity risk management program.
PCI: Does your organization print credit card numbers, statements, or collection notices? If so, how does your organization limit access to payment card information? What policies and procedures do you have in place to prevent employees from stealing that information? Undergoing a PCI DSS assessment allows printing businesses to validate their policies and procedures regarding the protection of PII and assure their clients that the payment card information they are printing is secured.
NIST Risk Management: Are you partnering with federal organizations? Have you been asked to use the NIST 800-53 framework to assess your security controls? While using the NIST framework is a great way to validate your security controls, because most printing companies are non-federal organizations, using the NIST 800-171 framework would be a more appropriate choice.
HIPAA & HITRUST: Do you print healthcare billing statements or list of benefits? As a business associate, printing companies must ensure that they comply with the HIPAA Security and Breach Notification Rules.

Benefits of Information Security Audits for the Printing Industry

Engaging in regular information security audits helps any organization demonstrate that they are committed to improving and maintaining their security posture. For the printing industry, though, it goes a step further and gives organizations a competitive advantage. For example, if a printing company is looking to partner with a publicly traded company, chances are they’ll be asked to provide a SOC report, because the company wants to ensure that the organization has mature systems and will be able to protect the information they are going to print. If the printing business does not have a SOC audit performed, the publicly traded company’s audit firm will advise that they do not partner with the printing company because of the liability of engaging with a business that can’t demonstrate the effectiveness of its internal controls. In short, undergoing information security audits gives printing organizations the competitive advantage of being the most secure company in their industry.

Regardless of the type of information printing companies print, securing the people, processes, and technologies used must be a top priority. Every device connected to the Internet is a gateway for a possible cyber attack. This means that even the printing industry is susceptible to the increasing cyber threats and must perform their due diligence to ensure that the vulnerabilities in their systems are identified and mitigated. Don’t put your or your business partners’ reputation, finances, or operations at risk. Contact us today to learn how KirkpatrickPrice can help you protect your business and assure your business partners that you’re performing your due diligence.