Synology Outlines Six Cybersecurity Criteria for Corporate Compliance

by Joanne Weng, Director, International Business Department, Synology

In today’s digital age, information security is a critical issue that enterprises can no longer ignore. With the increasing number of ransomware attacks, the challenges of managing cross-border data flows, and geopolitical factors, businesses are faced with more and more challenges when it comes to data management and protection. These phenomena have also accelerated the creation of corresponding laws and regulations by governments and relevant organizations worldwide.

For instance, Taiwan has passed the “Cyber Security Management Act,” requiring companies to establish information security management systems and adopt appropriate technologies and measures. Many companies also need to obtain the ISO 27001 certification, which just last year added more control measures. Moreover, if businesses fail to meet regulatory requirements, they may face restrictions, penalties, or even exclusion from the supply chain in various industries. This makes compliance no longer an option but a necessity.

Since this is closely tied to a company’s reputation and relationships, Synology expects that information security compliance will become an increasingly important factor in corporate operations.

Lack Of Clear Implementation Methods in Most Regulations Leads To Confusion For Businesses
When helping our clients plan their compliance strategy, we’ve found that a common struggle is the initial compliance implementation assessment. While the goal of protecting data is clear, most regulations only offer basic directions and require companies to demonstrate compliance without providing specific recommendations.

Here are some common examples of how compliance clauses are usually stated:

1. Sarbanes-Oxley Act (SOX): A regulation that mainly regulates U.S. listed companies, requiring the protection of financial data and reports and the development of disaster recovery plans for sensitive information.

2. Health Insurance Portability and Accountability Act (HIPAA): A U.S. regulation for the healthcare industry ensures patient medical data confidentiality, specifies how long patient data can be retained and requires backup and disaster recovery plans for data protection.

3. General Data Protection Regulation (GDPR): An E.U. regulation that requires companies to protect personal data, allows individuals to request data deletion, and requires backup plans to comply with individual rights.

When faced with numerous complex laws and regulations without clear guidance on how to implement them, it can be difficult for company compliance units to know where to start.

Start With ISO 27001 To Meet Many Security Standards at Once
To address these challenges, Synology recommends starting with the implementation of the ISO 27001 system. ISO 27001 is an international standard that helps organizations establish Information Security Management Systems (ISMS). Since its security requirements overlap significantly with other standards, such as HIPAA and GDPR, it’s one good way to address several compliance regulations at once.

The following diagram shows one example of ISO 27001’s similarities with other standards by highlighting the similarities with HIPAA.

1.1

This means that by meeting ISO 27001, most of the other information security requirements of other regulations can be met at the same time. Only specific industry requirements need to be fine-tuned or customized to ensure your organization’s compliance with relative standards.

Six Audit Checkpoints to Meet Data Protection Measures
Synology aims to make data protection compliance easy for organizations of all sizes. To achieve this, we have outlined the following six audit checkpoints. If an organization can answer “yes” to the following questions, it meets the basic data protection requirements for most regulations:

1. Complete backups: Can data be efficiently and regularly backed up, ensuring restoration to specific versions?

2. Backup verification: Are backup data truly secure, and are they proven to be recoverable?

3. Data immutability: Do you have a copy of the data that cannot be tampered with or deleted at will?

4. Restoration drills: Do you regularly simulate response strategies and procedures for unexpected events?

5. Offsite secondary backups: Are backup data stored in different locations and media?

6. Instant restorations: Can data be restored, and services restarted within an acceptable time frame?

If it is not currently possible to achieve all of these points, don’t worry. By using a modern solution like Synology’s Active Backup Suite, these audit checkpoints can automatically be met. This backup suite helps IT personnel easily create a complete data protection strategy by deploying multi-version and multi-destination data backups. Not only does this help you meet the six major audit checkpoints, but there are no license fees, making it a cost-effective option to achieve compliance with information security regulations.

We’ve outlined how Synology products do this in the following table, where the regulation requirements for ISO 27001: Control 8.13 are used:

1.2

Deploy Active Backup Suite Today to Comply With Data Protection Standards
Compliance with data protection laws is crucial for business operations, and failure to comply can have direct negative consequences. Take HIPAA for example: If healthcare institutions or related organizations fail to comply with HIPAA requirements, such as failing to protect patient medical information or failing to take the appropriate security measures, fines for each violation can reach up to $1.5 million USD. Not only that, but it can also severely damage a company’s reputation.

According to Synology’s survey, over 80% of companies are aware of data protection compliance laws but lack a comprehensive and adaptable data security solution. The Synology Active Backup Suite helps IT personnel turn ideas into actionable plans to ensure the security and recoverability of company data while fulfilling data protection compliance requirements.