Most organizations require some level of personally identifiable information (PII) or personal health information (PHI) for business operations. This information comes from partners, clients, and customers. Information such as social security number, tax identification number, date of birth, driver’s license number, passport details, medical history, etc. are all considered confidential information.
As such, organizations creating, storing, or transmitting confidential data should undergo a risk assessment. Risk assessments are required by a number of laws, regulations, and standards. Some of the governing bodies that require security risk assessments include HIPAA, PCI-DSS, the Massachusetts General Law Chapter 93H 201 CMR 17.00 regulation, the Sarbanes-Oxley Audit Standard 5, and the Federal Information Security Management Act (FISMA).
Organizations often question the need for compliance and adherence to these regulations. At Synopsys, we feel that an organization is required to undergo a security risk assessment to remain compliant with a unified set of security controls. Controls that are implemented and agreed upon by such governing bodies.
In fact, these controls are accepted and implemented across multiple industries. They provide a platform to weigh the overall security posture of an organization. Governing entities also recommend performing an assessment for any asset containing confidential data. Assessments should take place bi-annually, annually, or at any major release or update.