|
Voluntary Requirements May Not Always Be Voluntary
The Department of Health and Human Services weighed in on the cybersecurity policies back in February. They released what they called Cybersecurity Performance Goals (CPGs) that are a set of guidelines that are intended for healthcare agencies to use. These were released as voluntary, however, which sparked a debate for some experts in these areas.
In particular, a representative of Google was one of the first to step in and point out the these may be voluntary now, but the CPGs serve as an indicator of what will likely soon become requirements. They urged people to take the time to try and implement changes over time rather than be stuck having to suddenly implement the needed changes when the requirements are enforced.
It certainly fits an ongoing trend. For years there's been discussion on "best practices" and other methods that help to increase cybersecurity just for organizations to announce some of these things will now become requirements.
The SEC made a similar "voluntary" last summer that seemed designed to allow organizations under their jurisdiction to choose what they want to implement but included the caveat that they may begin pressing charges in the event of a breach when certain suggestions were not adhered to. The PA State Police and FBI announced the adoption of previously voluntary CJI data protection measures earlier this year (read about it in our previous Tech Talk News on our website).
Even at a less governmental level, this is the pattern we've been seeing with cyber insurance policies. They seem to throw more and more questions out over time. Almost no one can answer yes to all of their suggested security measures, but some carriers have begun to require more and more of these be followed to get a policy from them.
While it's not something to stress over immediately, it is something to keep in mind. When you see a questionnaire or guideline like that, it may be a good idea to take a look at implementing an extra thing or two to try and keep ahead of the curve of upcoming regulations. Our team has worked through plenty of these with a wide variety of organizations, so please feel free to reach out to our offices to review any such documents. We'll be happy to see where you stand and let you know if there are reasonable measures you could take to comply in additional criteria.
| 
