Breaking Into the U.S. Market: Cybersecurity Compliance to Fuel International Growth

Originally published by BARR Advisory.

Expanding into the U.S. market offers Europe-based cloud service providers (CSPs) exciting new growth opportunities—but cybersecurity standards aren’t exactly the same across the pond.

For security leaders who are used to GDPR and other European frameworks, it may come as a surprise that there is no national, comprehensive data privacy legislation in the United States. But while adhering to compliance frameworks like ISO 27001 and SOC 2 isn’t federally mandated, it is often required in order to do business with parties in the U.S.

Many businesses operating in the U.S. expect to be able to review a SOC 2 report in addition to an ISO 27001 certification before signing on new vendors. There are also state-level regulations, including the California Consumer Privacy Act (CCPA), that outline more stringent data security requirements.

If you’re just starting to dip your toes into the U.S. market, here’s everything you need to know about security compliance in the American public and private sectors:

SOC 2

In North America, a System and Organization Controls (SOC) 2 report is a popular way for CSPs to demonstrate their commitment to data security. SOC 2 examinations do not result in a certification; instead, the result is a CPA’s report attesting to the effectiveness of an organization’s controls over one or more of the five trust services criteria developed by the American Institute of CPAs (AICPA):

• Security: The system is protected against unauthorized access (both physical and logical).
• Availability: The system is available for operation and use as committed or agreed.
• Processing Integrity: System processing is complete, valid, accurate, timely, and authorized to meet the entity’s objectives.
• Confidentiality: Information designated as confidential is protected as committed or agreed.
• Privacy: Personal information is collected, used, retained, disclosed, and disposed of to meet the entity’s objectives.

Current and potential customers can use a SOC 2 report to evaluate a cloud service organization’s data security and threat mitigation procedures as part of their vendor risk assessments. This helps build trust with stakeholders and position your organization as one that prioritizes security and reliability.

Because SOC 2 is more common within North America, achieving compliance against both frameworks is a valuable way to differentiate your organization in the U.S. market.

ISO 27001

The American National Standards Institute (ANSI) National Accreditation Board (ANAB) is a member of the IAF, the same global organization that oversees the United Kingdom Accreditation Service (UKAS). Because ANAB’s accreditation is recognized internationally and adheres to the same rigorous standards as other leading accreditation bodies like UKAS, organizations in the U.K. and around the world can achieve ISO 27001 certification with ANAB-accredited auditors. This flexibility allows U.K.-based organizations to choose certification bodies based on their specific needs, without being restricted solely to UKAS-accredited firms.

For fast-growing CSPs, it makes sense to prioritize working with a firm that specializes in simplifying complex auditing processes with a proven, coordinated approach.

FedRAMP

CSPs aiming to do business with U.S. government agencies must comply with FedRAMP, a cloud security framework that establishes strict data security and risk management standards related to access rights, vulnerability scanning, system monitoring, incident reporting, and more.

Achieving FedRAMP authorization is a detailed process that requires careful planning and the assistance of a qualified Third-Party Assessment Organization (3PAO). This opens the door for your company to compete for government business and can give you a competitive advantage over other cloud service providers when bidding as part of a government RFP process.

HIPAA

Another U.S. federal requirement that can apply to CSPs headquartered internationally is the Health Insurance Portability and Accountability Act (HIPAA). Organizations that operate outside the U.S. that process, store, and interact with protected health information (PHI) belonging to American patients may be subject to HIPAA security requirements, which include administrative, physical, and technical safeguards for protecting electronic PHI (ePHI):

• Administrative: This includes controls related to risk analysis and risk management, termination procedures, access authorization, password management, data backup plans, and disaster recovery plans.
• Physical: This includes controls related to facility access, workstation use and security, and device and media controls such as data backup and storage.
• Technical: This includes controls related to unique user identification, emergency access procedures, encryption, and decryption.

Unlike standards like ISO 27001 and FedRAMP, there is no formal certification or authorization for HIPAA compliance.

Other Frameworks

Government assessments and SOC 2 reports aren’t the only options for organizations to demonstrate robust risk management practices to U.S. customers. Other frameworks that are common in North America include:

• HITRUST: Considered the gold standard in information security, HITRUST offers three validated assessments at varying levels of assurance, giving organizations a practical, scaled option for demonstrating adherence to data security best practices.
• CSA STAR: Designed specifically for cloud service organizations, the CSA STAR program integrates seamlessly with SOC 2 and ISO 27001 standards and helps cut down on time spent completing third-party risk questionnaires by publishing an updated registry of compliant organizations.
• PCI DSS: While not a legal requirement, the Payment Card Industry Data Security Standard (PCI DSS) is mandated by the international PCI Security Standards Council. If your organization stores, processes, or transmits cardholder data, then you are likely required to comply with PCI DSS.