A Compliance Program for the Retail Industry
GRC Labs provides retailers of all sizes a cost-effective, unified platform to manage controls across multiple frameworks, and a dashboard that lets CISOs monitor key performance indicators for compliance and IT security efforts.
The regulatory burden
E-commerce has made barriers to entering the retail sector low, so retailers must compete by knowing their customers and offering the right good, at the right time, at the right price. That requires data. The more you collect, the more you can analyze, and the better you can compete.
At the same time, retailers also want to grow quickly across multiple regions and countries, with a low-skill workforce subject to high turnover, So they need IT systems with low investment costs, that can scale rapidly and offer easy-to-use, flexible applications.
Security and compliance risks around the collection of data have never been higher. Consider some of the data a retailer is likely to collect:
- Name
- Credit card
- Address
- Age
- Nationality
- Purchasing history
The above are just for point-of-sale transactions with major credit cards. If the retailer runs its own credit card program or conducts e-commerce, it will collect customers’ credit histories, user IDs and passwords, and more.
All of that data is subject to protection from multiple laws, that can reach across multiple jurisdictions. U.S. retailers, for example, strive to demonstrate compliance with the PCI DSS framework to protect credit card data. A business that collects data about European Union citizens will need to confront the EU’s General Data Protection Regulation.
Compliance Objective
The new PCI DSS 3.2 standard that has already gone into effect will push companies to demonstrate ongoing compliance with security standards, not simply to pass annual assessments every 12 months.
Retailers can work with multiple frameworks, PCI DSS included, to achieve those objectives. Tracking risk assessments, gap analyses, and remediation efforts across multiple frameworks, however, can be daunting.
Assess vulnerabilities in the network and application layers.
Remediate any weaknesses.
Report risk assessments and remediations.
Analyze data collection for non-compliant behaviors.
Map progress on those remediation efforts.
Integrate new threat alerts or updated regulations into your compliance program.