Follow Kara Linkedin Twitter Facebook
Email Kara Email
Legal Issues
Jan 15, 2016

The First Step Of Cybersecurity Plans: Know Your Data And Its Location

Sponsored Content provided by Kara Gansmann - Attorney, Cranfill Sumner & Hartzog LLP

This article in a series on cybersecurity for businesses delves into the first of five main goals of a company’s cybersecurity policy: taking stock of all personal information your business possesses, locating it within your business, and identifying who has access to it. Understanding how personal information moves into, through and out of your business is essential to assessing cybersecurity vulnerabilities.
 
What is personal information? “Personal information” is statutorily defined in North Carolina to include a person’s first name or initial and last name in combination with any of the following: Social Security numbers, employer taxpayer identification numbers, driver’s license or state identification numbers, passport numbers, checking and saving account numbers, credit and debit card numbers, PINs, digital signatures, biometric data, fingerprints, any number that can be used to access financial resources, or a parent’s legal surname prior to marriage. An individual’s email name or address, Internet account number, Internet username, or password may be considered personal information if it would permit someone to access financial accounts or resources. Information in publicly available directories, such as a phone book, or government records such as a person’s name, address, and phone number, is not “personal information” under North Carolina identity theft laws.
 
Where to find personal information: We often think of personal information as just being electronically stored, but it can also be in paper records stored at or by your company. While each business’s collected personal information will vary, here are some places to locate it within your company:

  • Inventory Equipment: Examine your file cabinets, computers, mobile devices, flash drives, disks, employees’ home computers if used for work, digital copiers and other equipment to determine where sensitive data is stored. 
  • Assess Access and Use of Personal Information: Talk to your salespeople, IT staff, HR staff, accounting personnel and outside service providers to get a complete picture of how personal information is received and used in your company. Know who sends personal information from your business. Consider how personal information is received into your business, whether it is by email, website, call centers, contractors or mail. For example, do customers submit payment card information to your company online? If so, where is it stored and for how long? Evaluate what kind of personal information is collected at each point of entry into your business and where that particular kind of information is stored. Finally, examine which employees or others have access to personal information and whether that access is necessary. Identify whether unauthorized people could also access that same information, including vendors who supply or update software or contractors in a call center.
  • Know the Law: While you are taking stock of the data in your files, take stock of the applicable laws. Certain state and federal laws may require your particular business to provide reasonable security for certain sensitive data.
While different data presents varying risks, knowing the kind of personal information your business possesses and where your business keeps it is the first step in a cybersecurity plan to protect your company. In my next article, you’ll learn about step two of a cybersecurity plan: scaling down necessary personal information.
 
Kara Gansmann, a North Carolina native, is an associate in Cranfill Sumner & Hartzog LLP’s Wilmington office, where she focuses her litigation and appellate practice on various aspects of labor and employment law, business and contractual disputes, medical malpractice, and HOA matters. To contact Kara Gansmann, call (910) 777-6055 or email her at [email protected].  
 

Other Posts from Kara Gansmann

Wbj insights revised 0510 121615113531
Ico insights

INSIGHTS

SPONSORS' CONTENT
Chris coudriet

Connecting Resources For Safer Schools And Community

Chris Coudriet - New Hanover County Government
Dave sweyer 300 x 300

RENTAL PROPERTIES: TO FURNISH OR NOT TO FURNISH?

Dave Sweyer - Sweyer Property Management
Brookeskipper saltair headshot2

The Risk Of Having An Improperly Sized Heating And Air System

Brooke Skipper - Salt Air

Trending News

Woody White Blasts UNCW After Resigning As Trustee

Cece Nunn - Sep 24, 2021

UNCW's Chancellor Sartarelli Plans To Retire

Cece Nunn - Sep 24, 2021

Custom Builder Moves Into New Office After Repurposing Former Church Building

Cece Nunn - Sep 23, 2021

Long-vacant Wrightsville Ave. Properties Coming Back To Life

Cece Nunn - Sep 23, 2021

New Launch Date Announced For TRU Colors Beer

Johanna Cano - Sep 23, 2021

In The Current Issue

Geospatial Startup Maps Growth

Providing a highly demanded service in a niche industry has allowed Wilmington-headquartered technology company Geo Owl to grow as an innova...


Free Trolley Refreshes Downtown Route

For visitors and locals alike, the free downtown trolley in Wilmington recently refreshed its route, offering access to more desired destina...


MADE Winners: Functional Product Category

Cape Fear Solar Systems, ComfyChemo LLC and Craftspace Inc. are winners in the MADE Awards Functional Product Category....

Book On Business

The 2021 WilmingtonBiz: Book on Business is an annual publication showcasing the Wilmington region as a center of business.

Order Your Copy Today!


Galleries

Videos

Trying to Grow a Business?
2020 Health Care Heroes
2020 WilmingtonBiz 100