Skip to main content

Standards

Standards represent compliance frameworks and regulations that organizations must adhere to. Openlane supports a wide range of industry standards including SOC 2, ISO 27001, NIST frameworks, and industry-specific regulations.

What is a Standard?​

A Standard in Openlane represents a formal compliance framework, regulation, or set of guidelines that defines security, privacy, or operational requirements. Standards provide the foundation for compliance programs by defining the controls and requirements that organizations must implement.

Compliance standards are a set of guidelines, rules, and best practices established by industry associations, government bodies or regulatory bodies to ensure that organizations operate in an ethical, legal, and responsible manner.

Compliance Significance​

Standards are critical in compliance management because they:

  • Define Requirements: Establish specific controls and procedures organizations must implement
  • Provide Structure: Offer a systematic approach to security and compliance
  • Enable Certification: Allow organizations to achieve formal certification or attestation
  • Facilitate Audits: Provide clear criteria for audit assessments
  • Support Risk Management: Help identify and mitigate compliance risks

Types of Compliance Standards​

Compliance standards typically address information security, privacy, risk management, and governance aspects of an organization. Here's a breakdown on the type of compliance standards:

  1. Regulatory compliance: These are mandated by law, and non-compliance with these frameworks is a non-starter. For example, GDPR, HIPAA, and PCI DSS.
  2. Industry-specific compliance: These are developed by industry associations as a set of best practices for a particular industry. For example, NIST cybersecurity for the technology sector, FISMA for federal agencies.
  3. Operational compliance: These standards boost your goodwill as they focus on ensuring reliability, integrity, and efficiency of an organization's operations and processes. For example, SOC 2, ISO 27001, COBIT for IT and governance.

List of Compliance Standards​

Compliance standards demonstrate your organization’s commitment to ethical practices, legalities, and most of all, data security. Here are some of the top compliance standards that you need to consider.

SOC2​

Systems and Organization Controls for Service Organizations: Trust Services Criteria - SOC2

  • SOC 2 is a framework that dictates how service organizations should process and handle customer information. It ensures the confidentiality, availability and integrity of the customer data. It was developed by the AICPA and is now one of the most commonly accepted standards.
  • SOC 2 evaluates an organization’s controls on 5 Trust Service Criteria or principles, namely security, availability, processing integrity, confidentiality, and privacy.
  • Any organizations that provide cloud-based services and SaaS solutions or processes customer data for other businesses should pursue SOC 2 compliance. This includes companies in healthcare, tech, and finance, as these are highly regulated industries that serve enterprise clients with stringent data security and protection laws and regulations.

NIST 800-53​

Security and Privacy Controls for Information Systems and Organizations - NIST SP 800-53 Rev. 5

  • The NIST is a non-regulatory federal body within the US Department of Commerce. They develop cybersecurity standards and best practices for primarily federal agencies and their contractors.
  • At its core, this framework provides a catalog of security and controls. It covers various touch points like access control, risk management, system maintenance, and incident responses.
  • The controls are adaptable, which allows the organization to tailor their implementation based on their risks and requirements. The flexibility it provides has made NIST 800-53 applicable to organizations beyond the federal agencies.

GDPR​

General Data Protection Regulation - GDPR

  • Introduced by the EU in 2018, GDPR is a data protection law. It is a global standard for data privacy. The law lays down a strict set of rules for handling the personal information of EU residents, covering how it’s collected, used, and stored.
  • The regulation applies to all organizations handling the personal data of the citizens of the European Union, regardless of where the organization is located. The GDPR grants EU citizens a range of data subject rights that include:
    • Right to access their personal data
    • Right to make amendments
    • Right to erasure
    • Right to object on how their data is being processed
  • Citizens of the EU have the right to access their personal data, make amendments, have it erased, and also reserve the right to object to how their data is being processed.

HIPAA​

Health Insurance Portability and Accountability Act - HIPAA

  • HIPAA or the Health Insurance Portability and Accountability Act is a federal law that mandates the creation of national standards to protect sensitive patient data from being disclosed without the consent of the patient. Meeting HIPAA compliance requirements is mandated by law and it came into effect by the US Congress in 1996.
  • HIPAA safeguards Protected Health Information (PHI) from unauthorized access, use, or disclosure. There are two components of this legislation, the Privacy rule and the Security Rule. The Privacy Rule has national standards for the protection of an individual’s medical information, giving patients control over their health information. The Security Rule establishes the standards for the security of ePHI, or electronic Protected Health Information. It requires covered entities to appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and security of ePHI.

ISO 27001​

International Organisation for Standardization's Information Security Management Standard - ISO 27001

  • ISO 27001 is a standard for managing and implementing Information Security Management Systems or ISMS. It provides a comprehensive framework for organizations to manage and protect sensitive data and information.
  • ISO 27001 covers an array of security measures, from access controls, and cryptography to incident management and business continuity planning. This standard is a great way to demonstrate your commitment to information security and build trust with your customers and stakeholders.

NIST CSF​

NIST Cybersecurity Framework - NIST CSF

  • NIST Cybersecurity framework is a voluntary framework that manages cybersecurity risks. It has five core functions:
    • Identify:
      • Identifying and cataloging your critical assets and risks.
      • Understanding the legal and contractual obligations that impact your cybersecurity posture.
      • Establishing clear roles, responsibilities, and policies for managing the risks.
      • Identifying vulnerabilities and threats and assessing their likelihood.
      • Developing a plan to address these risks.
    • Protect:
      • Ensuring authorized access to controls and systems.
      • Educating employees about cybersecurity.
      • Protecting sensitive information.
      • Patching and updating the system.
      • Implementing firewalls, intrusion detection systems, and encryption.
    • Detect:
      • Identifying and analyzing unusual activities which could indicate a possible cyber attack.
      • Continuously monitoring systems for security.
      • Establishing a clear process to detect and report incidents.
    • Respond:
      • Have a plan of action for incident reporting, containment, eradication, and recovery.
      • Establishing clear lines of communication and proper protocols for reporting of security incidents.
      • Taking steps to mitigate the impact of incidents.
      • Improving response plans based on previous incidents.
    • Recover:
      • Restoring critical data after an incident.
      • Maintaining clear communications with the stakeholders.
  • CSF, while specific, has room for flexibility so that you can customize it according to the needs of your organization.

PCI-DSS​

Payment Card Industry Data Security Standard - PCI-DSS

  • The Payment Card Industry Data Security Standard, PCI DSS for short, is a data security standard developed by credit card companies, namely VISA, AmEx, Discover, Mastercard, and JCB to ensure merchants, vendors, and service providers handle credit card data securely.
  • The standard has 12 main requirements and can be organized into 6 categories:
    • Building and maintaining secure network systems
    • Protecting cardholder data
    • Maintaining a vulnerability management program
    • Implementing strong access control measures
    • Monitoring and testing networks regularly
    • Maintaining a security policy for sensitive information
  • These categories of PCI DSS cover various security measures, from firewalls and encryption to security policies.

NIST 800-171​

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations - NIST SP 800-171 Rev. 2

CIS​

Center of Internet Security - CIS

  • CIS benchmarks are a set of 18 best security practices for organizations to improve their cybersecurity. They are widely recognized as global standards for securing IT systems against the most pervasive threats. CIS benchmarks are a set of configurations for various security areas, such as:
    • Operating systems (Windows, Linux, macOS)
    • Software applications
    • Server software security settings (email servers, databases)
    • Cloud service providers (AWS, Azure, Google cloud)
    • Mobile operating systems (iOS, Android)
  • The CIS controls cover a wide range of security aspects, from data recovery and continuous vulnerability management to email and web browser protection and malware defense. These controls are divided into 153 safeguards and categorized into 3 groups: IG1, IG2, and IG3. They are implemented based on the need and maturity of the organization.

Other notable standards​

  • Federal Information Security Modernization Act - FISMA
  • Federal Risk and Authorization Management Program - FedRAMP
  • Sarbanes-Oxley Act - SOX

How do you choose the right compliance framework for your business?​

You have to consider the following factors when it comes to deciding which compliance(s) to choose:

  • Industry: The frameworks standards your business should follow will depend on your industry. For example, HIPAA is mandatory for healthcare while PCI DSS is for those who handle credit card data.
  • Geography: If you process personal data from the EU, or have personal data collected from California, you will need GDPR and CCPA compliances, respectively.
  • Customer requirements: Customers are data sensitive. They may require you to comply with certain specific standards as a prerequisite for doing business. For example, enterprises require their vendors to be SOC 2 compliant.
  • Legal requirements: The nature and jurisdiction of your business is another factor to consider. Healthcare industries are required to be HIPAA compliant, Companies operating data of EU citizens are required to be GDPR compliant.
  • Competitive advantage: Having international and widely recognized standards can help differentiate your business and drive enterprise level deals. It not only sets you apart from your competitors but also shows invested parties your commitment to security and privacy.

You can speak to key stakeholders like IT, legal, HR, and business heads to understand your business obligations and requirements. Once you have identified the relevant compliance standards and regulatory requirements for your business, develop a roadmap for implementation.

It is critical you understand that compliance is not a one time fix. Even with a single regulation to maintain, the efforts are continuous and a simple oversight can result in severe consequences.

Beyond fines, what are the consequences of noncompliance?​

While hefty fines and penalties are the center of attention when it comes to noncompliance, there are a cascade of other consequences for your organization:

  • Legal action: In severe cases noncompliance can lead to lawsuits and even if you prevail, they are very expensive to defend. Chegg, an edutech company, was sued by the FTC for over $40 million for lax data security practices. The company had over 4 security breaches since 2017, exposing private information held by them.
  • Disbarment: Based on the severity of the noncompliance, regulatory bodies can disbar your organization from specific activities.
  • Lost opportunities: Many businesses require frameworks like SOC 2 or ISO 27001 as a prerequisite for doing business with them. Noncompliance can limit your growth potential.
  • Eroded customer trust: Data breaches and cyberthreats usually stem from noncompliance. These incidents not only erode the trust your existing customer has placed on you, but also hinders your ability to acquire new customers.
  • Sales cycle: Noncompliance can lead to a longer sales cycle as you scramble to become and demonstrate compliance to your potential clients. Ultimately this gives your competition an edge and you could end up losing valuable deals.