What does data security compliance mean for today’s small business?

Whether you're a large enterprise or a small business, ensuring your data is secure isn't important just for its own sake, it's likely to also be required by compliance regulations.

If you’re a large, established enterprise or organization, your IT department likely has the staff, time and expertise to keep on top of compliance concerns, including any new requirements as they arise (which they will).

But if you’re a local retail store with primarily Point-of-Sale (POS) and inventory management plus a website and email newsletter, or a mid-sized start-up with a somewhat more built-out or cloud-based IT infrastructure, you’re probably still somewhere on the learning curve.

Here’s a summary overview of what your company should know, be asking about, looking for, and doing in terms of ensuring your data security is compliant.

There are good financial reasons to secure your data as tightly as possible. It can be expensive to leverage state-of-the-art data encryption and other security measures, but it’s far less expensive than paying the price of a data breach. HIPAA fines alone can run up to millions of dollars; other costs can include having to pay for a year or more of identity theft protection for every member impacted by such a breach.

There are many compliance regulations, at the national, state, and industry levels. Ones you’re likely to have read about in the news include FERPA, FINRA, HIPAA, PCI DSS, Sarbanes-Oxley, and Gramm-Leach-Bliley.

And there’s lots of others, like C-TPAT, a worldwide supply chain security initiative established in 2004, and state regulations like Massachusetts 201 CMR 17 (aka Mass Data Protection Law).

And you can’t ignore regulations from states or countries that your business isn’t located in — if you have customers or supplies there, you may have to add these to your comply-with list.