Month: September 2021

By: Mark Houpt, Chief Information Security Officer, DataBank

“Compliance audit.” These two words alone are often enough to trigger immediate feelings of panic in even the most experienced business or technology leader. In fact, compliance audits may rank higher than root canals or even extended visits from our in-laws on a list of things we all dread the most.

In some ways, the compliance audit’s bad reputation seems to be well deserved. (Fortunately, we have an answer to compliance challenges below, so keep reading.) After all, compliance can be a major effort, one that could lead to future issues. Managing data, records, workflows, and specific processes in order to comply with many different industry regulations can be extremely time-consuming, require specialized skills or headcount, or take valuable time away from already busy employees.

How Did We Get Here?
While there are many different types of compliance audits today—workplace safety, quality management, environmental issues, and more—cybersecurity is often the most challenging. This is true because so many different regulations—such as HIPAA, PCI DSS, Sarbanes-Oxley, and GDPR—all have rigorous standards related to data privacy.

Additionally, so many companies today are embracing new technologies as part of an overall digital transformation effort. While “going digital” clearly positions them to reap new benefits, it also may introduce new cybersecurity vulnerabilities. All of this can make operations much more difficult, both in terms of actually safeguarding sensitive data but also when it comes to compliance efforts and preparing for an audit.

To understand the scope of work required and to see how you can improve your response to audits, let’s take a closer look at them and what they entail.

What is a Compliance Audit?
A compliance audit is an independent review to determine if your company is meeting the specific requirements of a compliance standard or regulation. Each compliance audit is conducted by external auditors—not internal teams or employees. These auditors generally follow a specific checklist based on the audit guidelines of the standard or regulation being assessed.

While no one has ever accused compliance audits of being fun, they can help in a few different ways. First, they may provide new insights that identify existing gaps that could subject your company to additional risk. They may also reveal new opportunities for improvement, such as the need for new processes or additional cybersecurity training. Most important: they can help your company avoid potential severe penalties and other negative consequences related to non-compliance.

Data Center Providers Can Make All the Difference
If all of this sounds ominous, we do have some good news. Selecting the right data center partner can actually give you a real advantage when it comes to compliance and compliance audits. For example, DataBank helps our customers improve cybersecurity and simplify compliance efforts in a number of important ways:

• Secure, compliant infrastructure: All DataBank infrastructure is secure and fully compliant with the security requirements of industry regulations: FedRAMP / FISMA, HIPAA, PCI-DSS, SSAE-18, GDPR – Privacy Shield, ITAR, NIST, and StateRAMP. This compliance standing is passed to you as a DataBank customer. Not only do you gain a compliant hosting environment, but any systems, applications, and workloads located in our data centers are compliant, too.
• Compliant services: In addition to infrastructure security, we also provide a wide range of compliance-related services such as ongoing monitoring, back-ups, and disaster recovery. DataBank also operates as a managed security service provider (MSSP) for a significant percentage of our customers. We use intrusion detection systems (IDS), intrusion prevention systems (IPS), and other specialized cybersecurity platforms. In this scenario, DataBank customers benefit from economies of scale—instead of having to purchase these expensive systems themselves, they can take advantage of our investment and let us use these tools on their behalf.
• Compliance reporting: Too often, a looming audit requires employees to drop everything and attempt to find the right information they need as evidence of compliance. Unfortunately, this generally takes too much time, pulls employees away from other important work, and could even lead to damaging errors. To solve this challenge, DataBank provides a portal with access to many different types of compliance reports. Not only does this reduce the amount of time required for busy employees to attempt to produce these reports, such a wide variety also helps deliver the exact evidence auditors need to make the process go smoothly.
• Compliance expertise: Finally, if an auditor has follow-up questions or seeks details that your team can’t answer, DataBank’s CISO, Mark Houpt, and dedicated security team can engage further to provide backup information, additional knowledge, and best practices to further streamline the entire process.

Cybersecurity Compliance Help from an Unexpected Source
If you’re wrestling with compliance—especially cybersecurity—while also considering new options for colocation, you may be pleasantly surprised to learn just how much data center providers can provide. In many cases, you can gain a security approach that exceeds your own capabilities and a critical advantage when it comes to potential cybersecurity audits.

Interested in learning more about DataBank’s commitment to cybersecurity and compliance? Contact us today for more information.