Operations
1/4/2017
02:00 PM
John Moynihan
John Moynihan
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

A Vendor's Security Reality: Comply Or Good-Bye

Privacy compliance is now mission critical. Third-party suppliers that fail to meet data protection mandates will be excluded from doing business in lucrative vertical markets.

The Health Insurance Portability and Accountably Act (HIPAA) Omnibus Rule and the Federal Information Security Management Act (FISMA) have introduced an unprecedented emphasis on third-party compliance. For those providing services within the healthcare sector or to the federal government, privacy compliance is now mission critical. Although vendor compliance has long been clouded in ambiguity, these directives provide much needed and long-overdue clarity to the vast vendor community.

Unfortunately, many vendors have yet to address their compliance obligations and are now scrambling to salvage customer relationships. Federal regulators, awakened by the expansion of outsourcing and the unending drumbeat of vendor breaches, have turned their focus directly toward service providers and the risks they pose. The result is that vendors face a new and stark reality: comply or good-bye. Those that fail to meet specific data protection mandates ultimately will be excluded from doing business in these lucrative vertical markets.

HIPAA Omnibus Rule
The HIPAA Omnibus Rule represents a dramatic change to healthcare regulation and jolted the vendor community. Although enacted in 2009 as part of the Health Information Technology for Economic and Clinical Health (HITECH) Act, the effective date was postponed until September 2013. The Omnibus Rule addresses important issues such as disclosure and patient rights, but the most significant change, from a data protection perspective, relates to the responsibilities of "business associates" — any entity that "creates, receives, maintains or transmits protected health information on behalf of a health care provider or insurer."

Before September 2013, healthcare vendors were required to meet minimal data protection standards, while hospitals, health clinics, and insurance plans were subject to the full scope of HIPAA's Privacy and Security Rules. The Omnibus Rule, however, subjects vendors to requirements that had previously applied only to covered entities. Therefore, vendors must implement a combination of administrative, technical, and physical safeguards to ensure the security of protected health information or be exposed to the consequences of a regulatory violation.

Specifically, vendors are required to:

  • Conduct a formal risk assessment
  • Implement measures to mitigate internal and external risk
  • Implement written policies governing the security of protected health information
  • Conduct data security training for all employees
  • Restrict physical access to storage of protected health information
  • Protect workstations and electronic media
  • Implement technologies to prohibit unauthorized access
  • Log all electronic access of protected health information
  • Secure electronically transmitted protected health information

In addition to experiencing disruption of customer relationships, healthcare vendors are now exposed to significant financial penalties from the Department of Health and Human Services for failure to comply with HIPAA. Should you doubt the government's resolve in enforcing the rigorous business associate requirements, several vendors have been fined in excess of $500,000 since the implementation of the Omnibus Rule.

FISMA
FISMA was enacted in 2002 as a framework for ensuring the security of systems that support government operations. It requires all federal agencies, entities administering federally funded programs, federal grant recipients, and government contractors to develop, document, and implement a program to secure federal information and corresponding systems. FISMA mandates that those subject to the law implement "baseline security controls" through a combination of managerial, operational, and technical measures and is aligned with NIST 800-53, the National Institute of Standards and Technology's outline of security controls for federal information systems.

Although third-party service providers have been subject to FISMA since its enactment, vendor compliance has been prioritized over the past few years. This development has prompted government contractors to pursue FISMA compliance or risk exclusion from the federal vendor community. Enforcement of FISMA's third-party standard is being performed primarily through the procurement process, with all prospective vendors required to attest to adherence with rigorous data security controls when responding to a solicitation. The specific language within contract awards mandates that vendors submit evidence of FISMA compliance in the form of monthly, quarterly, and annual deliverables.

Accordingly, if your company is doing business with a government agency, you will be required to provide detailed and ongoing evidence of compliance. Additionally, agencies are increasingly deploying audit teams to perform on-site verification of a vendor's control environment.

The following list, taken directly from a Federal Highway Administration RFP, details the specific documents that vendors must provide as evidence of FISMA compliance:

  • Security assessment: formal evaluation of control environment (annual)
  • Plan of action: plan to mitigate assessment findings (quarterly)
  • System security plan: documentation of all controls (annual)
  • Security categorization: impact level of each system (annual)
  • System contingency plan: documentation of redundancy (annual)
  • Security policy and workforce training records (annual)
  • Interconnection agreements from sub-contractors (annual)

The New Reality
Although meeting the enhanced requirements of HIPAA or FISMA will entail additional resources, third-party service providers should view this as a critical, long-term investment. The reality is that vendors operating within highly regulated industries must be capable of demonstrating compliance to each customer. Therefore, those who are unable to meet the new regulatory mandates will find themselves on the outside, looking in.

Related Content:

John Moynihan, CGEIT, CRISC, is President of Minuteman Governance, a Massachusetts cybersecurity consultancy that provides services to public and private sector clients throughout the United States. Prior to founding this firm, he was CISO at the Massachusetts Department of ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.