Follow Kara Linkedin Twitter Facebook
Email Kara Email
Legal Issues
Jan 15, 2016

The First Step Of Cybersecurity Plans: Know Your Data And Its Location

Sponsored Content provided by Kara Gansmann - Attorney, Cranfill Sumner & Hartzog LLP

This article in a series on cybersecurity for businesses delves into the first of five main goals of a company’s cybersecurity policy: taking stock of all personal information your business possesses, locating it within your business, and identifying who has access to it. Understanding how personal information moves into, through and out of your business is essential to assessing cybersecurity vulnerabilities.
 
What is personal information? “Personal information” is statutorily defined in North Carolina to include a person’s first name or initial and last name in combination with any of the following: Social Security numbers, employer taxpayer identification numbers, driver’s license or state identification numbers, passport numbers, checking and saving account numbers, credit and debit card numbers, PINs, digital signatures, biometric data, fingerprints, any number that can be used to access financial resources, or a parent’s legal surname prior to marriage. An individual’s email name or address, Internet account number, Internet username, or password may be considered personal information if it would permit someone to access financial accounts or resources. Information in publicly available directories, such as a phone book, or government records such as a person’s name, address, and phone number, is not “personal information” under North Carolina identity theft laws.
 
Where to find personal information: We often think of personal information as just being electronically stored, but it can also be in paper records stored at or by your company. While each business’s collected personal information will vary, here are some places to locate it within your company:

  • Inventory Equipment: Examine your file cabinets, computers, mobile devices, flash drives, disks, employees’ home computers if used for work, digital copiers and other equipment to determine where sensitive data is stored. 
  • Assess Access and Use of Personal Information: Talk to your salespeople, IT staff, HR staff, accounting personnel and outside service providers to get a complete picture of how personal information is received and used in your company. Know who sends personal information from your business. Consider how personal information is received into your business, whether it is by email, website, call centers, contractors or mail. For example, do customers submit payment card information to your company online? If so, where is it stored and for how long? Evaluate what kind of personal information is collected at each point of entry into your business and where that particular kind of information is stored. Finally, examine which employees or others have access to personal information and whether that access is necessary. Identify whether unauthorized people could also access that same information, including vendors who supply or update software or contractors in a call center.
  • Know the Law: While you are taking stock of the data in your files, take stock of the applicable laws. Certain state and federal laws may require your particular business to provide reasonable security for certain sensitive data.
While different data presents varying risks, knowing the kind of personal information your business possesses and where your business keeps it is the first step in a cybersecurity plan to protect your company. In my next article, you’ll learn about step two of a cybersecurity plan: scaling down necessary personal information.
 
Kara Gansmann, a North Carolina native, is an associate in Cranfill Sumner & Hartzog LLP’s Wilmington office, where she focuses her litigation and appellate practice on various aspects of labor and employment law, business and contractual disputes, medical malpractice, and HOA matters. To contact Kara Gansmann, call (910) 777-6055 or email her at [email protected].  
 

Other Posts from Kara Gansmann

Wbj insights revised 0510 121615113531
Ico insights

INSIGHTS

SPONSORS' CONTENT
Cd

Don't Forget the "B"

Hoop Morgan - The Forté Institute, LLC
Web awstaffpic2020 1 132245438

The Luncheon for Literacy: More than a Meal

Alesha Edison Westbrook - Cape Fear Literacy Council
Jc300 dsc 2735

The Primary Way Families Break the Cycle of Poverty

JC Lyle - Wilmington Area Rebuilding Ministry

Trending News

Galleria Property On Wrightsville Ave. Sold For $37.5M

Cece Nunn - Aug 10, 2022

Leland Town Center Lands New Tenant; Lowe’s Begins Construction

Johanna F. Still - Aug 10, 2022

Pipeline Poke Headed To Autumn Hall

Elizabeth White - Aug 10, 2022

Rachael Ray, Emeril Lagasse To Appear At GLOW Event

Justin Williams Pope - Aug 10, 2022

New Biz Creations In Cape Fear Region Continue Strong Trend

Johanna F. Still - Aug 9, 2022

In The Current Issue

Commercial Tenants Navigate Rent Spikes

One of the realities small businesses throughout the area face when trying to find commercial space, which also include increasing rents and...


Film On Rebound; New Horse Enters Race

New soundstages in Wilmington are set to be constructed toward the end of the year – marking activity that appears hasn’t happened since the...


Schools Face Nursing Shortage Crises

The pandemic-induced havoc on hospitals around the country still ricochets across systems today. A dire trend accelerated and emerged: a sho...

Book On Business

The 2022 WilmingtonBiz: Book on Business is an annual publication showcasing the Wilmington region as a center of business.

Order Your Copy Today!


Galleries

Videos

Trying to Grow a Business?
2020 Health Care Heroes
2020 WilmingtonBiz 100