By now every compliance officer has already heard the warning that it’s a matter of when you suffer a cyber-security breach, not if. Then comes compliance with breach disclosure rules—and those demands are becoming as perplexing as the cyber-threat itself.
Virtually every state in the country has its own breach notification law, and seven states have their own laws for data security standards. A host of federal agencies have their own regulations protecting consumers’ financial data, health records, data collection, and more; each with its own disclosure requirements. Then there are the frameworks, such as those from the Committee of Sponsoring Organizations and the National Institute of Standards and Technology, that offer guidance on how to build strong security controls.
