By Greg Hoffer
The New Year marked an important milestone in our national history. For the first time, we’re seeing a state turn commercial industry standards for data security and privacy into law.
Nevada’s new privacy legislation, which took effect on January 1, requires government agencies and companies that conduct business in the state and accept payment cards to comply entirely with the Payment Card Industry Data Security Standard (PCI DSS). Those agencies and companies that do not accept payment cards cannot electronically transmit customers’ personal information nor move data storage devices containing customer data outside of the business unless the transmission or data storage device is encrypted. In the statute, another well-known industry standards organization, the National Institute of Standards and Technology (NIST), is used to define acceptable encryption practices.
Security standards put forth by organizations such as PCI and NIST have long been leveraged, independently, by both public and private industry in the U.S. to mitigate the inherent risk posed by electronically transferring sensitive data inside and outside of an organization, and in storing it once it reaches its destination. Updated regularly and crafted by some of the world’s leading information security experts, such industry standards represent a necessary baseline for any organization to improve its overall security procedures. These standards are an excellent place for lawmakers to start when forming meaningful cyber security legislation that protects U.S. citizens, or anyone who does business within the U.S.
While it’s not surprising, it is disappointing that it has taken this long for commercial data security and privacy standards to make their way into public policy. Why haven’t local, state and the Federal governments taken swifter action in protecting their citizens from data breaches? After all, widely publicized breaches like Heartland or, more recently, Google’s China-based attack, (or the many less publicized breaches) have become all too commonplace. They emphasize the risk that all organizations that house or deal with sensitive information face in protecting their digital assets, and serve as a reminder of the profound vulnerability our entire nation faces in protecting the security and privacy of its citizens.
I laud the recent actions of the Nevada State Government in pioneering a security partnership between government and industry. Such actions set a poignant example of how we can work together to protect the sensitive information of citizens. More states — not to mention the Federal government — must follow this example if we are to improve our overall national cyber security procedures.
