Infosec in the Small Business World

Over the past few years, it is becoming increasingly more common for clients to come to us asking that to fill out a security questionnaire from one of their vendors or investors.  A decade ago this was almost unheard of.  While all companies where we are located are required by law to have a Written Information Security Plan (WISP) and keep it up to date, these rules are largely ignored.  No one is checking to see if you are following the rules, and the concept of a WISP in the SMB world is hard to implement if they even can.  They are hard enough to achieve in corporate environments.

 Where does one begin?

• You can search for "sample WISP," and you will get plenty of excellent examples, but do not try to implement this on your own.  Make sure that you have owner by in, involve HR, your IT staff, and your general counsel.
• Have your IT team start with implementing ISO27K based standards.  If you apply and follow these standards, you will have a good solid foundation for most other audit standards.

Make sure that you ask your vendors for the following:

• SOC reports
• if they meet PCI DSS (required for credit cards)
• if they are HIPAA compliant (the US health care industry rules dealing with patient data)
• if they have a WISP, and when was it last reviewed (should be reviewed yearly)

If you do not want to lose out on business or be in the unfortunate position of being involved in a data breach, reach out for help to your IT professional.  The penalties for not being compliant are high, and claiming that you did not know or understand the law is not an excuse.