Ricoh Canada
smb data security compliance

What does data security compliance mean for today’s small business?

Summary

Summary overview for ensuring your data security is compliant.

Read time: 4 minutes

Whether you're a large enterprise or a small business, ensuring your data is secure isn't important just for its own sake, it's likely to also be required by compliance regulations.

If you’re a large, established enterprise or organization, your IT department likely has the staff, time and expertise to keep on top of compliance concerns, including any new requirements as they arise (which they will).

But if you’re a local retail store with primarily Point-of-Sale (POS) and inventory management plus a website and email newsletter, or a mid-sized start-up with a somewhat more built-out or cloud-based IT infrastructure, you’re probably still somewhere on the learning curve.

Here’s a summary overview of what your company should know, be asking about, looking for, and doing in terms of ensuring your data security is compliant.

Close up of server parts

What does data security mean?

In a nutshell, data security means that your company’s sensitive data is secure from being read, copied, changed, or deleted by snoopers, thieves and other cybercriminals.

This includes data “at rest” — on computers, mobile devices, storage systems, and removable storage media (flash drives, CD/DVDs, external hard drives, SD cards, etc.), and “in motion” — as data traverses local, wide-area, wireless and cellular networks.

Securing data is likely to be a mix of securing the data proper — through encryption, possibly in some cases through redaction (blocking/blanking specific fields or parts of a record or file), and securing the device or network.

What does “data security compliance” mean?

How much and what type of data security do you need? One answer is: enough to keep your data secure. But that’s too vague an answer to be useful.

One place to start is, “What will satisfy my company’s legal obligations?”

This means: What rules and regulations, whether from government(s) or your industry, must your data security comply with, and what do these regulations identify as the minimum necessary protection(s)?

These rules reflect the current state of technology — what type of tools are required or recommended, e.g., 256-bit AES encryption — and legal requirements, fines and penalties.

Is your small business compliant?

Engage security consultants to help you protect your data.

See how our cybersecurity services can help

How do I ensure my small business is compliant?

One good place to start is by looking at your competitors’ and suppliers’ websites to see what they say about their own compliance.

– Identify relevant laws and industry policies your company must be compliant with

– Determine what of your existing IT infrastructure, applications, activities, and data currently are in compliance

– Select replacement or additional security products and services to meet compliance requirements

– Obtain any required certifications for these products and services, and for your company’s IT compliance status

Lastly, be sure to educate all your employees regarding what they have to do — and not do — as part of compliance. For example: Don’t take sensitive company, customer or patient data records off-site unless they are properly encrypted.

Data security means that your company’s sensitive data is secure from being read, copied, changed, or deleted by snoopers, thieves and other cybercriminals.

How do I ensure my small business is compliant?

One good place to start is by looking at your competitors’ and suppliers’ web sites, to see what they say about their own compliance.

  • Identify relevant laws and industry policies your company must be compliant with.

  • Determine what of your existing IT infrastructure, applications, activities, and data currently are in compliance.

  • Select replacement or additional security products and services to meet compliance requirements.

  • Obtain any required certifications for these products and services, and for your company’s IT compliance status.

Lastly, be sure to educate all your employees regarding what they have to do — and not do — as part of compliance. For example: Don’t take sensitive company, customer or patient data records off-site unless they are properly encrypted.

Recommended for you

SMBs must be serious about information security
SMBs must be serious about information securityArticles

SMBs must be serious about information security

Data security breaches are likely inevitable. It takes powerful resources skilled in data security and steady monitoring to confront today's threats.

How to solve AP processing problems
How to solve AP processing problemsArticles

How to solve AP processing problems

Streamline invoice processing, reduce costs, and enhance accuracy, with our AP processes. All backed by our expertise in business process outsourcing.

5 server security concerns you need to know
5 server security concerns you need to knowArticles

5 server security concerns you need to know

Server security concerns exist whether your server is locked in a data center, sits in an office or is hosted in the cloud.