Reasonable Security Updates

Reasonable Security.

Data security and regulations require ‘reasonable security’ for information management. The answer to what ‘reasonable security’ meant or how it should be applied was debated. The concept of “Reasonable security” means that safeguards must not pose a higher risk to the organization than the lack of safeguards poses to others. The Sedona Conference recently released Commentary on a Reasonable Security Test “to address what “legal test” a court or other adjudicative body should apply in a situation where a party has, or is alleged to have, a legal obligation to provide “reasonable security” for personal information, and the issue is whether the party in question has met that legal obligation.“

As the cybersecurity landscape evolves with more advanced threats, it’s important to understand how reasonable security applies to our changing environment and specific organizations. Below are recent developments on this important topic, how companies are impacted, and why it is essential to define reasonable risk and security.

CIS Risk Assessment Method (RAM) v2.0 for CIS Controls v8

The Center for Internet Security (CIS) recently released the CIS Risk Assessment Method (RAM) v2.0, an information security risk assessment method to help enterprises justify investments for reasonable implementation of the CIS Critical Security Controls (CIS Controls).

Genetic Information Privacy Act (GIPA)

The Act requires direct-to-consumer genetic testing companies to “Implement and maintain reasonable security procedures and practices to protect a consumer’s genetic data against unauthorized access, destruction, use, modification, or disclosure.” GIPA will go into effect on January 1, 2022.

New Connecticut Law Incentivizes Adoption of Cybersecurity Standards

“This new law (Public Act 21-119) enacted by the Connecticut Legislature on July 6, 2021, was created with the goal of incentivizing businesses to adopt cybersecurity standards by offering protections to those that implement the reasonable cybersecurity controls identified in the law.”

FTC Revises the Safeguards Rule and Proposes Mandatory Reporting of Cybersecurity Events

“Service Provider Oversight: These provisions require the financial institution to take reasonable steps to select and retain service providers that are capable of maintaining reasonable safeguards. This provision also requires the inclusion of contractual provisions that require service providers to implement and maintain appropriate safeguards.”

Customers Can Pursue Negligence Claims Directly Against Vendor

“… Blackbaud had a duty to protect Plaintiffs from the criminal conduct of third parties based on Blackbaud’s own negligent conduct in creating the risk by failing to use reasonable security measures.”

Insurance Coalition Executive Director Issues Public Comment on Comptroller of the Currency Notice

Proposed Interagency Guidance on Third-Party Relationships: Risk Management “We believe that expanded guidance is needed on reasonable risk acceptance philosophies, with examples of areas where occasional trigger and appetite exceedances are understood and generally accepted by both regulators and customers.”

UC San Diego Health sued over data breach that may have exposed records of 500,000 patients

“The lawsuit alleges that UC San Diego Health failed to implement reasonable security practices and adequately train employees on how to avoid phishing attacks,”