Top-of-the-line data security practices, programs

Ross Federgreen, Chief Executive Officer and founder of payment and data privacy consultancy CSR Professional Services Inc., frequently finds himself correcting misconceptions about data security. Take the Payment Card Industry Data Security Standard (PCI DSS): "PCI is a misguided concept these days," he said, noting that despite years of outreach and education, many small merchants, whether they realize it or not, are not compliant.

"They check off all the self-certifying boxes, and that's a mistake," he said. "It has absolutely nothing to do with the realities of the world and the big players who spend tens of millions of dollars on very sophisticated systems that still get hacked all the time."

Federgreen also noted that only 4 to 7 percent of breaches are bankcard related; over 90 percent target other types of personally identifiable information (PII), such as birth dates and Social Security, driver's license, and automated clearing house routing numbers.

Payments at the core

Federgreen served as an adviser to the United States Senate, the U.S. Agency for International Development and numerous multinational corporations. When he founded Jensen Beach, Fla.-based CSR in 1999, he was drawn to payments because "payments are at the core of what is keeping people in business," he said. CSR's initial goal ‒ to offer compliance remedies for regulatory headaches ‒ remains relevant today.

CSR offers a range of data privacy and security tools and services for businesses, organizations and even schools. These include the patented CSR Breach Reporting Service, which facilitates timely, accurate PII data breach reporting and consumer notifications; the patent-pending CSR Readiness Suite, a data life cycle management program that provides online risk evaluation, remediation and employee training material related to PII; and Stand-In Privacy Officer (SIPO), which provides comprehensive consulting for midsize and large companies.

Breach reporting

The consequences of not reporting breaches can be drastic, with "very serious dollars" assessed in penalties, Federgreen noted. Additional damages include class-action lawsuits, years of federal oversight, civil and possibly criminal prosecution, and reputational damage and loss of sales, he said.

The CSR Breach Reporting Service provides a single point for clients to call when a breach has been detected. "We report that information to all of the appropriate parties at the federal, state and local levels and to the brand as required based upon what data was stolen," Federgreen said. Companies are under a tight timeline to report breaches, and they "usually don't have the business bandwidth to do it," he added.

Readiness and expert guidance

The CSR Readiness Suite provides online, interactive data risk assessment to identify gaps; risk mitigation tools including an incident response plan; policy templates and best practices; proof of efforts to comply with regulations; 24/7 access to services to maintain data privacy strength; and privacy compliance training.

As data privacy regulations change, many companies will also need to have certified Privacy Officers. CSR's SIPO solution provides clients with top Certified Information Privacy Professionals (CIPPs) with certifications in the United States, Canada and the European Union.

"We have four CIPPs in our organization, so we're fully certified to provide these services," Federgreen said. Internally, CSR has 25 to 30 individuals comprising teams to address clients' specific needs and performance criteria. Federgreen estimated that 85 percent of CSR's clients are ongoing. "We're all about education and learning," he said. "That's true in everything we do."

ISO benefits

With the commoditization of payment processing, income from value-added services has become critical. Meanwhile, mass-market distribution of CSR's products through ISO channels has made its online compliance solutions affordable to a majority of merchants, Federgreen stated. Our services "bring stability to the acquirer relationships," he said. "They give the merchant and provider and their partners the leading edge in PII issues over time." Federgreen sees significant opportunity ahead for CSR's ISO partners. "We are continuing to grow our team of certified individuals, expanding dramatically on a global basis," he said.

Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.