Citadel Information Group

  • Home
  • About Us
    • About Citadel
    • Who We Are
    • When To Call Citadel
  • Services
    • Overview: Delivering Information Peace of Mind ® to Business and the Nonprofit Community
    • Citadel’s Information Peace of Mind ® Program
    • Assessments and Reviews
    • Information Security Policies and Standards
    • Secure The Human
    • Phishing Defense Training
    • CCPA and Defendable Security Procedures and Practices
    • Privacy: Information Inventory / Data Mapping
    • Security Management of the IT Network / Infrastructure
    • Incident Response / Business Continuity
    • Secure Application Development — Learn By Doing
    • Litigation Support
    • Keynotes
    • Client Success Stories
  • Blog
  • Resources
    • Information Security Library
      • Citadel Guides
      • Awareness Posters
      • For Boards and the C Suite
      • Cybersecurity Law
      • Cybersecurity Surveys
      • HIPAA HITECH
      • Insurance and Risk Management
      • National Cybersecurity
      • Online Bank Security
      • Payment Card Industry Data Security Standard
      • Personal Cybersecurity
      • Securing the IT Network
      • Helpful Links
    • Blogs
      • Cybersecurity Blogs
      • Leadership and Culture Change Blogs
  • Contact
You are here: Home / Overview: Delivering Information Peace of Mind ® to Business and the Nonprofit Community / CCPA and Defendable Security Procedures and Practices

CCPA and Defendable Security Procedures and Practices

Reasonable Security Procedures and Practices

The California Consumer Privacy Act (CCPA) private right of action establishes statutory damages of between $100 and $750 per incident for consumers whose personal information has been compromised by a breach of personal information resulting from the business’ “violation of the duty to implement reasonable security procedures and practices appropriate to the nature of the information to protect the personal information. (CA Civil Code Section 1798.150(a)(1)).

The statutory exposure for a company with as few as 10,000 “qualifying data elements[1]” is between $1,000,000 and $7,500,000. This combined with the legal duty to acknowledge a breach should one occur, significantly increases the financial risk of a breach.

This increases the importance to an organization that it have and maintain appropriate reasonable security procedures and practices.

Given the financial exposure of a breach, the prudent business will want to ensure it can be defended against a claim that it has failed to implement appropriate reasonable security procedures and practices. Since it is a breach that will trigger consumer action, special attention should be put on defensive strategies that significantly lower the likelihood of a breach.

At the present time, however, there is no accepted legal definition for what constitutes appropriate reasonable security procedures and practices.The answer will necessarily depend on the size of the company, the quantity and nature of the information it collects and sells, etc.

SecureTheVillage, a nonprofit that brings together information security practitioners, IT professionals, attorneys, risk managers, law enforcement, educators, and others, has developed a set of Minimum Reasonable Information Security Practices. The objective of this minimum set of practices is to support development of an explicit legal standard that certain practices are so basic that a business’ failure to implement them would serve as prima facie evidence that the business’ security procedures and practices are not reasonable. The Minimum Reasonable Information Security Practices are designed to be a floor on reasonableness.

How Citadel Can Help — Defendable Security Procedures and Practices

Citadel Information Group has provided information security management services to businesses and the nonprofit community for 17 years. Our operational in-the-trenches experience coupled with the work we and our colleagues have done at SecureTheVillage have given us extensive experience in the operational meaning of reasonable security procedures and practices.

Citadel first implements security procedures and practices designed to ensure that the organization meets the minimum practices. We follow this up with additional procedures and practices to ensure appropriate reasonable security procedures and practices are in place. This provides the foundation of appropriate reasonableness.

  1. We conduct a “gap analysis” to identify what, if anything, needs to be done to implement Citadel’s proprietary Information Security Management Program. Our program has been designed in accordance with the information security management standards identified above to be compatible with SecureTheVillage’s Minimum Reasonable Information Security Practices.
  2. We work with the client to fully implement Citadel’s Information Security Management Program. This step serves as the foundation for being defendable.
  3. We work with the client and it’s legal team to document any additional security procedures and practices that might be needed in the client’s particular situation. Together with the Information Security Management Program these are designed to form appropriate reasonable security procedures and practices.
  4. We then work with the client — often in the role of vCISO — to implement appropriate reasonable security procedures and practices.

Meeting Other CCPA Privacy Requirements

In addition to ensuring defendability, Citadel also assists companies ensure their ability to comply with CCPA’s request to disclose and to delete.

  1. Data Inventory / Data Mapping: We work with the client to identify and document the consumer information it has
    1. Desktops, databases, servers, websites, cloud platforms, laptops, mobile devices and other platforms where information is located
    2. 3rd-parties with which it shares information
  2. We work with the client to ensure its ability to delete customer information upon request
  3. We work with the client to implement appropriate data retention and destruction procedures

For More Information

Citadel Blog Post: CCPA and Minimum Reasonable Security Procedures and Practices: A Floor on “Defendability”

SecureTheVillage: Minimum Reasonable Security Practices

SecureTheVillage California Consumer Privacy Act (CCPA), including 3 webinars

 

 

We invite you to contact us for more information on how Citadel’s CCPA, GDPR, and Other Information Security and Privacy Management Services can provide you Information Security Peace of Mind®.

Contact Us

Contact Us

optional
Are you an attorney? *
reCAPTCHA

By submitting this form, you give us permission to contact you.

 

Call us for a free confidential consultation:
323-428-0441

Get our newsletter

A weekly report of critical security updates and the latest cybersecurity news delivered to your inbox from Secure The Village.

Sign Up

Overview: Delivering Information Peace of Mind ® to Business and the Nonprofit Community

  • Citadel’s Information Peace of Mind ® Program
  • Assessments and Reviews
  • Information Security Policies and Standards
  • Privacy: Information Inventory / Data Mapping
  • SecureTheHuman
  • Client Success Stories
  • Security Management of the IT Network / Infrastructure
  • Phishing Defense Training
  • Incident Response / Business Continuity
  • CCPA and Defendable Security Procedures and Practices
  • Litigation Support
  • Secure Application Development — Learn By Doing
  • Keynotes

Get in touch

323 428 0441
info@citadel-information.com

Citadel Information Group
Citadel on Linkedin
SecureTheVillage on Linkedin

About Us

Citadel Information Group is a full service integrated information security management / governance firm. We work either consultatively or as part of a client’s senior management team, assisting our clients cost-effectively manage the confidentiality, privacy, integrity and availability of their information. Learn more.

Key Resources

  • The Citadel Way to Information Security Management
  • Creating a Cybersecurity Aware Culture
  • Secure Application Development: The CISO’s Role – a webinar with WhiteHat Security
  • Information Security Library

Copyright © 2018 by Citadel Information Group  All Rights Reserved | Privacy Policy