Cyber Insurance – What Is It and What is Covered Under a Cyber Insurance Policy?

by Benjamin Wright / December 19, 2022

Cyber insurance – a hot topic in the law of data security. Many insurance companies have started issuing policies for cyber incidents and cyber breaches – But, what should be covered under a cyber insurance policy? Since there is no standard policy for cyber insurance, you are likely to find vastly different policies from a number of difference insurance companies. Enterprises looking to use insurance to manage information security risk…

Guide to PCI Compliance – Navigating PCI DSS v3.2

by KirkpatrickPrice / April 12, 2023

What is the PCI DSS? The PCI Security Standards Council was jointly developed by the payment card brands to encourage and enhance cardholder data security and facilitate the broad adoption of consistent data security measures globally. It ensures that all data that lives within the Cardholder Data Environment (CDE) is protected and secured from theft or unauthorized use. Any merchant, service provider, or sub-service provider who stores, processes, or transmits…

3 Data Security & Privacy Best Practices for Your Employees

by Benjamin Wright / December 19, 2022

Why is Data Security & Privacy Important? It is considered best practice, and often required, for organizations to develop, document, and implement an information security policy. An information security policy acts as an agreement with employees with respect to data security and privacy best practices. This set of policies is often seen in the form of a binding employee handbook, or contract, and should be updated on an annual basis,…

PCI Requirement 2.6 – Shared Hosting Providers Must Protect Each Entity’s Hosted Environment

by Randy Bartels / December 22, 2022

What is a Shared Hosting Provider? PCI Requirement 2.6 exists to protect hosting environments. When multiple clients’ data is all on the same server, the security of the server often becomes susceptible to vulnerabilities. For example, one client could create insecure functions, but because the data is under the control of a single environment, the other clients’ data would also become compromised. This is why PCI Requirement 2.6 requires that…

PCI Requirement 2.5 – Ensure Security Policies Are Known to All Affected Parties

by Randy Bartels / December 22, 2022

Ensure that Policies and Procedures are Documented, In Use, and Known to All Affected Parties PCI DSS Requirement 2.5 addresses one of the most important aspects of the assessment. It directs, “Ensure that security policies and operational procedures for managing vendor defaults and other security parameters are documented, in use, and known to all affected parties.” If vendor defaults and other security measures are not continuously managed, it’s harder to…