To mitigate the risk of exposing customers' personally identifiable information to unauthorized users, companies may wish to formulate PII policies.
In the last two years, the global shift to remote work has precipitated major changes in the methods and targets of cybercrime. As workloads moved to the cloud, remote access points and vulnerabilities proliferated, inviting cybercriminals to focus on remote workers and technologies. Following recent FBI warnings concerning digital identity verification, the surge in attacks targeting remote workers and their personally identifiable information (PII) – now accounting for 67% of all cybercrime – has emerged as a high-security priority for businesses in all industries.
.png)
The U.S. General Services Agency (GSA) considers personally identifiable information (PII) to be any information that third parties can use to distinguish or trace an individual’s identity, whether consisting of a single data point or multiple data points combined to create an identifying link to a specific individual. Therefore it is important to prioritize identifying and safeguarding Personally Identifiable Information (PII) to protect against potential data breaches or theft of sensitive information.
The GSA does not limit the definition of PII to any specifically enumerated categories of information. Rather, the agency acknowledges that all personal information has the potential to become PII when integrated with other information.
Common examples of single-point PII include:
Potential PII information frequently consists of an individual’s:
U.S. law does not yet clearly define the legal liabilities for private businesses associated with sharing or leaking PII. In certain fields such as healthcare and education, specific regulations like HIPAA and FERPA apply. Nevertheless, most consumers expect even private companies who possess their PII to protect it and would decline to do business with those that do not.
To mitigate the risk of exposing clients’ PII to unauthorized access, companies can formulate PII policies to guide employee handling of PII. Though similar, PII policies differ from privacy policies. Privacy policies allow consumers to grant or limit the sharing of their personal information, while PII policies govern the use of PII internally without reference to consumer preferences.
To effectively regulate how employees handle PII internally, organizations need to first understand PII and where it currently exists in their systems. This process – called personal data mapping – involves deploying data inventory methods that identify PII. For all instances of PII, a personal data map should allow you to answer four questions that determine the security state of the information concerned.
Currently, there is no golden standard for what PII policies should necessarily dictate. Nevertheless, best practices will focus on restricting any unnecessary sharing of PII – internally as well as externally – and keeping PII off any public-facing applications. Basic PII policy parameters should stipulate that:
For organizations that handle sensitive consumer data and personally identifiable financial information, PII policies are an important part of data breach risk management. Nevertheless, with nearly 99% of businesses using at least one software-as-a-service (SaaS) platform and 56% now running at least half their workloads in the cloud, protecting/safeguarding PII requires more than just regulating data handling within your organization.
As third-party service providers continue to store and transmit more PII, organizations should choose their service providers carefully as data breaches remain largely endemic SaaS cloud environments. Among SaaS providers, 43% report experiencing unrecoverable data loss to ransomware and other cyberattacks in the last 12 months. To help organizations identify providers with high data security standards, the American Institute of CPAs maintains a set of voluntary compliance standards providers can choose to adopt to certify their trustworthiness. In the financial services industry, the de facto standard of these is SOC 2 Type 2 compliance.
.png)
FileInvite provides financial institutions with an integrated platform to streamline secure document collection. With client portals operating on bank-grade, SOC 2 Type 2 compliant security, FileInvite allows you to accelerate your document collection processes while providing your clients with the highest standard of data security.
To learn more and request a demo, visit FileInvite today.
Protect your clients' Personally identifiable information from unauthorized access, malicious cyberattacks, and other potential risks.
Financial institutions must understand personally identifiable financial information in order to prevent disclosing it. Here are some of the common...
For organizations that persist in sharing PII over email, there are three information security protocols you should enforce to minimize risk and...