us 
The Heavy Burden of Security & Compliance and 5 Digital Strategy Tips to Consider
Wednesday, 06 December 2017
In today’s digital world, we hear a lot about personalization, optimization and customer experience. These are the marketing benchmarks that digital businesses aim high for to continue engaging, acquiring and converting their user base. However, as these areas become top priorities, it’s more important than ever to ensure data practices are secure and compliant. Without a strategy and execution plan in place, customer data is at risk, and therefore your organization’s reputation and success.
Global e-retail sales are projected to grow 47% by 2020, which means businesses today need to have customer experience strategies and a well-thought-out operational execution plan to stay competitive. Part of this strategy should include a thorough security and compliance plan to cover all bases and protect against exposure of data that could essentially shut your organization down.
When it comes to security and compliance, there are hundreds of articles out there with recommendations of what you could do. But regardless of which path your organization decides to take your business needs to understand what it will be responsible for securing and ensure a strategy has been created.
Security and compliance can seem daunting but consider the following five tips to start your journey towards a more secure organization:
1. Make Protecting Customer Data Priority #1
For every business, online or otherwise, protecting customer data should be the number one priority. A great place to start is to ensure you are compliant with the Payment Card Industry Data Security Standard (PCI DSS). More often than not, online businesses accept credit cards as a form of payment and will store, process and transmit cardholder data to streamline processes for the customer’s future purchases. If your business intends to do the same, your organization or the solutions provider you plan to use must host data securely with a PCI compliant hosting provider (or be SAQ type D compliant). There are multiple requirements that meet several security goals so make sure you take the time to read through them carefully and know which ones apply. Another layer of security you may want to consider implementing is 2-factor authentication, which has been a proven approach to making sure business’ servers and website access are secure.
2. Recognize Which Countries’ Data Protection Laws Apply
If you do business or market to anyone outside of the country you live in, you’ll need to make sure you’re not only well versed but also compliant with their rules and regulations. If you have people in your database from Canada, you’ll need to follow Canada’s Anti-Spam Legislation (CASL). Doing business in Europe? You’ll need to read up on the EU General Data Protection Regulation (GDPR) and EU ePrivacy Directive and make sure you’re abiding by the rules. Each country and industry may have its own set of laws to abide by so do your homework and read up so you’re in compliance. Failure to do so can lead to substantial fines which sometimes lead to termination of operations.
3. Create a Security Strategy that Scales
Security and compliance needs will evolve over time, especially as your company grows. To keep up with these changes, companies should create a strategy that not only incorporates security and compliance in their overall digital business, but also provides steps to ensure it is being updated and understood thoroughly by staff. Consider it a program rather than a project. If you’re using solution vendors to optimize your business, making sure they are in compliance with the latest security standards can be a huge step in the right direction. The best and easiest approach is to ask for documentation and levels of certification.
4. Get Executive Buy-In & Support from the Beginning
Making a business case for security and compliance is much more difficult than it is to make a case for something like optimizing the customer experience. You’re bringing up a lot of hypothetical, worst-case scenarios that aren’t necessarily backed by concrete company data or trends and dealing with the analysis of risks and unpredictable situations. However, when you take a step back and factor in the potential losses that result from compliance failure, it makes everything much more real. The unfortunate downside of all of this is that you never really know how serious this is until it happens, and your business comes to a screeching halt and your customers can’t trust you anymore.
According to the recent ISACA survey, 82% of respondents “report that their enterprise board of directors is concerned or very concerned about cybersecurity” but only 43% of executives reported to follow good security protocol themselves. With this discrepancy, it’s difficult to make privacy and security a priority throughout an organization.
From the very beginning of a security and compliance program, it’s vital to not only get buy-in but commitment from your executive team to follow security procedures that will be rolling out. Their dedication is imperative to the success of any initiative.
5. Incorporate Security & Compliance into Your Company’s Culture
Security and Compliance isn’t just an IT initiative. It’s something that affects every member of an organization. If there’s a CRM database and your employees have access to customer data of any kind, they need to follow the security and compliance initiatives you implement for the safety of your customers and the entire digital infrastructure you have in place.
Have regular security training and exams to make sure employees are aware of procedures as well as protocols in case there’s a breach. It’s important that organizations take the time to be one step ahead when it comes to security and compliant to ensure they’re doing what they can to maintain customers’ trust and business.
