What’s Included in the Scope of Compliance?

With the growing number of data protection regulations, accurately defining the scope of compliance is vital for an organization. Too narrow of a definition leaves a company liable for penalties for non-compliance, while an overly broad scope of compliance makes achieving and maintaining compliance more difficult. After determining which compliance requirements apply to an organization’s operations, the next step is to define the scope of compliance. 

When considering the scope of compliance internally, an organization needs to carefully assess all of its devices and people authorized to access protected data. On top of that, organizations must make sure that the third parties they work with are also following compliance requirements. Essentially, any external partners that have access to protected data must also comply with the applicable regulations.

What devices and other technology are required to be compliant?

Most data protection regulations define the concept of anonymization. If data is properly anonymized (making it impossible to determine the original data), then it is not protected under the regulation.

This concept of anonymization is essential to understanding the scope of compliance for devices. Any device that has access to unencrypted and non-anonymized data is within the scope of compliance.  However, infrastructure that only has access to encrypted data—such as routers processing network traffic encrypted with TLS—is not within the scope of compliance.

When considering whether or not a device is within the scope of compliance, it is important to consider inter-device communications. If a device does not store protected data but has access to a device that does and the data that it contains, then it is within the scope of compliance.

Which employees need to follow compliance standards?

Compliance requirements for employees are similar to those associated with devices. If a user has or potential can access  sensitive data, then they need to follow regulatory compliance requirements. If not, then compliance is not mandatory, but might still be a good idea.

This is why strong access controls are an essential component of a regulatory compliance strategy.  If an organization can demonstrate that their access controls limit access to certain systems, then their compliance requirements are lower.

What types of third parties require compliance?

Some data protection regulations impact third-party service providers as well. In general, these requirements apply to contractors that have access to the sensitive data that is protected under the regulation. Some examples of regulations that have third party compliance requirements include:

• PCI: PCI compliance applies to whomever has access to payment card information.  If a third party is processing transactions for an organization, then they are subject to PCI regulations.
• HIPAA: HIPAA defines business associates as third parties that provide services to healthcare providers. For example, if a doctor uses a third-party billing service, the data shared with that service provider is subject to HIPAA regulations.
• CMMC: CMMC applies to the primary contractor on a US government defense contract and all of its subcontractors. Subcontractors are required to achieve at least Level 1 CMMC compliance, and higher levels may be required based upon their roles and the sensitivity of the contract they are supporting

Keep this rule of thumb in mind: if a partner has access to data protected under a regulation, then they also must be compliant with the regulation. This is why cloud service providers and similar organizations typically hold HIPAA and PCI DSS compliance certifications for their platforms.

Defining your scope of compliance

When preparing for a compliance audit, a correct scope of compliance is critical.  A good way to determine this scope is to work with a compliance specialist.  Hyper Vigilance provides a wide range of compliance management services to help organizations achieve and maintain compliance with applicable regulations. Get in touch with us to begin your journey to compliance.