{"id":569,"date":"2016-11-30T14:31:29","date_gmt":"2016-11-30T19:31:29","guid":{"rendered":"http:\/\/turinasbird.com\/?p=569"},"modified":"2016-12-05T00:45:41","modified_gmt":"2016-12-05T05:45:41","slug":"hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch","status":"publish","type":"post","link":"https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch","title":{"rendered":"The Hidden Cost Of Non-Prescriptive Cybersecurity Regulation: Have Regulators Begun To Catch On?"},"content":{"rendered":"<div pw:image='' class='pw-widget pw-counter-none pw-horizontal' pw:url=\"https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch\" pw:title=\"The Hidden Cost Of Non-Prescriptive Cybersecurity Regulation: Have Regulators Begun To Catch On?\" >\n\t<a class='pw-button-linkedin pw-look-native' ><\/a>\n\t<a class='pw-button-facebook pw-look-native' ><\/a>\n\t<a class='pw-button-googleplus pw-look-native' ><\/a>\n\t<a class='pw-button-twitter pw-look-native' ><\/a>\n\t<a class='pw-button-post-share' ><\/a>\n<\/div><p><a href=\"http:\/\/turinasbird.com\/wp-content\/uploads\/2016\/11\/Fotolia_98233375_S.jpeg\"><img decoding=\"async\" loading=\"lazy\" class=\"alignright size-full wp-image-570\" src=\"http:\/\/turinasbird.com\/wp-content\/uploads\/2016\/11\/Fotolia_98233375_S.jpeg\" alt=\"fotolia_98233375_s\" width=\"250\" height=\"167\" \/><\/a>As agencies such as the Federal Trade Commission (the &#8220;FTC&#8221;) and the New York State Department of Financial Services (the &#8220;NYSDFS&#8221;) begin review of their cybersecurity policies, it looks like the road ahead may be a bit more prescriptive. This could be a good thing for cloud-based service providers and their customers, both of whom could see costs decrease as vague standards are replaced with more specific guidance.<\/p>\n<p>Historically, regulatory agencies have resisted the call for specific cybersecurity guidelines for cloud-based service providers. Citing the rapidity at which technological options evolve, the varying size and financial strength of the parties involved, and the range in criticality of data, regulations are riddled with vague mandates to develop and maintain &#8220;effective&#8221; or &#8220;reasonable&#8221; security programs which include &#8220;consideration of the company&#8217;s size and complexity, the nature and scope of the company&#8217;s activities and the sensitivity of the data that is collected.&#8221; Vendors are expected to use &#8220;best practices,&#8221; and to be consistent with &#8220;industry standard&#8221; but what exactly that is, nobody truly knows.<\/p>\n<p><b>The Cost of Regulatory Ambiguity<\/b><br \/>\nFor the cloud service provider, this ambiguity creates a great economic toll and an increasing barrier to entry.<\/p>\n<p><u>Professionals and Consultants Required.<\/u> Because the reasonableness standard is developed through a steady trickle of case law and regulatory enforcement actions, the only way to truly understand the state of play is to engage professionals who have been tracking regulatory pronouncements and case law on an ongoing basis and who have been working with many players in the industry over a long period of time.<\/p>\n<p><u>Customer Insistence on Unreasonable Security Standards.<\/u> Because cloud customers are (i) in the dark about what &#8220;industry standard&#8221; actually means, (ii) fearful of data breach risk, and (iii) eager to pass as much risk and expense onto third party service providers, they often begin contract negotiations with unreasonably aggressive security requests. This creates an additional financial burden on the entire system as each side is forced to invest considerable time and energy into negotiating each and every service contract.<\/p>\n<p><b>A Trend Toward More Prescriptive Guidance?<\/b><br \/>\nWhether it is a coincidence or a recognition that more specific guidance is needed, this Fall, both the FTC and the NYSDFS announced plans to review cybersecurity guidance. In each case, there was a new (and welcome) interest in increased specificity.<\/p>\n<p><u>Proposed NYSDFS Regulations.<\/u> In September 2016, the NYSDFS announced proposed cybersecurity regulations for institutions under its jurisdiction. Among the more specific requirements (unless modified, scheduled to go into effect on January 1, 2017) for cloud service providers servicing NYFDFS regulated institutions are:<\/p>\n<ul>\n<li>Annual assessment of continued adequacy of security practices<\/li>\n<li>Multi-factor identification<\/li>\n<li>Encryption of data in transit and at rest<\/li>\n<li>Prompt notice of a cybersecurity event<\/li>\n<li>Identity protection services provided to customers impacted by a cybersecurity event due to negligence or willful misconduct<\/li>\n<li>Representations and warranties that service is free of viruses, trap doors, time bombs and other mechanism that would impair security<\/li>\n<li>Covered Entity audit rights<\/li>\n<\/ul>\n<p><u>FTC Safeguards Rule Review.<\/u> Similarly, in September of 2016 the FTC announced plans to review the Safeguards Rule. Among the items under consideration are whether the Safeguards Rule should specifically include the requirement of a breach response plan, and whether the rule should be more prescriptive in nature.<\/p>\n<p><b>Lower Administrative Costs Ahead?<\/b><br \/>\nWhile more specificity could lead to greater implementation costs, those costs could be offset by a reduction in legal costs associated with deciphering regulatory requirements and negotiating contracts. In addition, to the extent companies rely on consultants or other professionals to guide them through regulatory compliance, these services should become more stream-lined and &#8220;off the shelf.&#8221; Perhaps over time we will see spending going where it belongs: security dollars spent on creating information security.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>As agencies such as the Federal Trade Commission (the &#8220;FTC&#8221;) and the New York State Department of Financial Services (the &#8220;NYSDFS&#8221;) begin review of their cybersecurity policies, it looks like the road ahead may be a bit more prescriptive. This could be a good thing for cloud-based service providers and their customers, both of whom [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[69],"tags":[20,77,78,34,79,80],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>The Hidden Cost Of Non-Prescriptive Cybersecurity Regulation: Have Regulators Begun To Catch On? | Turinas &amp; Bird, LLC<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Hidden Cost Of Non-Prescriptive Cybersecurity Regulation: Have Regulators Begun To Catch On? | Turinas &amp; Bird, LLC\" \/>\n<meta property=\"og:description\" content=\"As agencies such as the Federal Trade Commission (the &#8220;FTC&#8221;) and the New York State Department of Financial Services (the &#8220;NYSDFS&#8221;) begin review of their cybersecurity policies, it looks like the road ahead may be a bit more prescriptive. This could be a good thing for cloud-based service providers and their customers, both of whom [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch\" \/>\n<meta property=\"og:site_name\" content=\"Turinas &amp; Bird, LLC\" \/>\n<meta property=\"article:published_time\" content=\"2016-11-30T19:31:29+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2016-12-05T05:45:41+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/turinasbird.com\/wp-content\/uploads\/2016\/11\/Fotolia_98233375_S.jpeg\" \/>\n<meta name=\"author\" content=\"Alison Bird\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alison Bird\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch\",\"url\":\"https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch\",\"name\":\"The Hidden Cost Of Non-Prescriptive Cybersecurity Regulation: Have Regulators Begun To Catch On? | Turinas &amp; Bird, LLC\",\"isPartOf\":{\"@id\":\"https:\/\/turinasbird.com\/#website\"},\"datePublished\":\"2016-11-30T19:31:29+00:00\",\"dateModified\":\"2016-12-05T05:45:41+00:00\",\"author\":{\"@id\":\"https:\/\/turinasbird.com\/#\/schema\/person\/7319da0a0d93fb913f7c3729b959f432\"},\"breadcrumb\":{\"@id\":\"https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/turinasbird.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Hidden Cost Of Non-Prescriptive Cybersecurity Regulation: Have Regulators Begun To Catch On?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/turinasbird.com\/#website\",\"url\":\"https:\/\/turinasbird.com\/\",\"name\":\"Turinas &amp; Bird, LLC\",\"description\":\"Strategic Counsel for Cloud Based Technology Companies &amp; Expansion\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/turinasbird.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/turinasbird.com\/#\/schema\/person\/7319da0a0d93fb913f7c3729b959f432\",\"name\":\"Alison Bird\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/turinasbird.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e694b8ce3302a2e9cc58df65808e9c34?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e694b8ce3302a2e9cc58df65808e9c34?s=96&d=mm&r=g\",\"caption\":\"Alison Bird\"},\"url\":\"https:\/\/turinasbird.com\/author\/alison-bird\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The Hidden Cost Of Non-Prescriptive Cybersecurity Regulation: Have Regulators Begun To Catch On? | Turinas &amp; Bird, LLC","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch","og_locale":"en_US","og_type":"article","og_title":"The Hidden Cost Of Non-Prescriptive Cybersecurity Regulation: Have Regulators Begun To Catch On? | Turinas &amp; Bird, LLC","og_description":"As agencies such as the Federal Trade Commission (the &#8220;FTC&#8221;) and the New York State Department of Financial Services (the &#8220;NYSDFS&#8221;) begin review of their cybersecurity policies, it looks like the road ahead may be a bit more prescriptive. This could be a good thing for cloud-based service providers and their customers, both of whom [&hellip;]","og_url":"https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch","og_site_name":"Turinas &amp; Bird, LLC","article_published_time":"2016-11-30T19:31:29+00:00","article_modified_time":"2016-12-05T05:45:41+00:00","og_image":[{"url":"http:\/\/turinasbird.com\/wp-content\/uploads\/2016\/11\/Fotolia_98233375_S.jpeg"}],"author":"Alison Bird","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Alison Bird","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch","url":"https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch","name":"The Hidden Cost Of Non-Prescriptive Cybersecurity Regulation: Have Regulators Begun To Catch On? | Turinas &amp; Bird, LLC","isPartOf":{"@id":"https:\/\/turinasbird.com\/#website"},"datePublished":"2016-11-30T19:31:29+00:00","dateModified":"2016-12-05T05:45:41+00:00","author":{"@id":"https:\/\/turinasbird.com\/#\/schema\/person\/7319da0a0d93fb913f7c3729b959f432"},"breadcrumb":{"@id":"https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/turinasbird.com\/2016\/11\/30\/digital\/hidden-cost-non-prescriptive-cybersecurity-regulation-regultors-begun-catch#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/turinasbird.com\/"},{"@type":"ListItem","position":2,"name":"The Hidden Cost Of Non-Prescriptive Cybersecurity Regulation: Have Regulators Begun To Catch On?"}]},{"@type":"WebSite","@id":"https:\/\/turinasbird.com\/#website","url":"https:\/\/turinasbird.com\/","name":"Turinas &amp; Bird, LLC","description":"Strategic Counsel for Cloud Based Technology Companies &amp; Expansion","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/turinasbird.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/turinasbird.com\/#\/schema\/person\/7319da0a0d93fb913f7c3729b959f432","name":"Alison Bird","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/turinasbird.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e694b8ce3302a2e9cc58df65808e9c34?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e694b8ce3302a2e9cc58df65808e9c34?s=96&d=mm&r=g","caption":"Alison Bird"},"url":"https:\/\/turinasbird.com\/author\/alison-bird"}]}},"_links":{"self":[{"href":"https:\/\/turinasbird.com\/wp-json\/wp\/v2\/posts\/569"}],"collection":[{"href":"https:\/\/turinasbird.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/turinasbird.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/turinasbird.com\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/turinasbird.com\/wp-json\/wp\/v2\/comments?post=569"}],"version-history":[{"count":0,"href":"https:\/\/turinasbird.com\/wp-json\/wp\/v2\/posts\/569\/revisions"}],"wp:attachment":[{"href":"https:\/\/turinasbird.com\/wp-json\/wp\/v2\/media?parent=569"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/turinasbird.com\/wp-json\/wp\/v2\/categories?post=569"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/turinasbird.com\/wp-json\/wp\/v2\/tags?post=569"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}