ICT Today

38 I ICT TODAY 38 I ICT TODAY When it comes to physical security, there are a few basic guidelines that should be part of a cybersecurity roadmap. But first, it is useful to know the applicable law within each vertical. REGULATORY COMPLIANCE The number of breached records in business organiza- tions jumped significantly in 2019 with over 8.5 billion records exposed—that is more than three times greater than 2018 year-over-year—according to the 2020 IBM X-Force Threat Intelligence Index. The report goes on to cite that the over 8.5 billion records that were compromised in 2019 was more than a 200 percent increase than those lost in 2018 and "The inadvertent insider can largely be held responsible for the significant rise." Another report, The Cost of Insider Threats: A Global Report 2020 published by IBM and the Ponemon Institute, states that insider security threats have increased signifi- cantly in frequency and cost. In fact, from 2016 to 2019 the frequency of incidents per company has tripled from an average of 1 to 3.2 and the average cost has almost doubled. Insider security threats mean that serious data breaches can be caused internally by disgruntled or mali- cious employees, contractors, those engaged in competi- tive espionage or other criminally-minded insiders within an organization. These statistics do not even account for the inadvertent insiders who may cause data breaches via human error and non-malicious intent. The global average cost of a data breach in 2019 was $3.92 million, and the most expensive country in terms of average total cost of a data breach was the U.S. at $8.19 million, more than twice the global average, according to a study by Security Intelligence. 1 With each data breach costing businesses millions of dollars, regulatory compli- ance and strict cybersecurity measures are no longer a choice; they are part of the cost of doing business and must be closely watched. All data privacy standards and regulations require physical access control measures for data processing and storage equipment, but with most regulations, it is up to organizations to decide which specific method or tech- nology to use. Because of sensitive data privacy concerns, certain segments of the industry—particularly health care and financials—look at cabinet access control more strictly, requiring a detailed report of who, when and why the cabinet is accessed. Regulations and access-control-related requirements ICT designers and installers should know include: entities to "Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed. Access to hardware and software must be limited to properly authorized individuals." Under HIPPA, companies are required to document access attempts, including dates and reason for access. These notes can vary from a simple logbook to a more comprehensive electronic database. The HIPAA rules affect organizations that handle individual health care records, such as pharmacy, dental, vision and medical service providers, insurance, billing, wellness programs, health tracking apps and even gymnasiums. The Health Insurance Portability and Accountability Act access-control-related requirements include: • Limit physical access to electronic information systems and the facility or facilities in which they are housed. • Document access attempts, dates and reason for access. The U.S. Department of Health and Human Services Breach Portal indicated more than a dozen organizations were being investigated from January-April 2020 for unauthorized access breaches with millions of dollars of expected fines. Health Insurance Portability and Accountability Act (HIPAA) The Centers for Medicare & Medicaid Services (CMS) has the rule titled Security Standards for the Protection of Electronic Protected Health Information, which requires covered

• Cover