{"id":2914,"date":"2019-07-05T13:38:00","date_gmt":"2019-07-05T19:38:00","guid":{"rendered":"https:\/\/trustarc.com\/?post_type=resource&p=2914"},"modified":"2024-12-17T09:54:16","modified_gmt":"2024-12-17T15:54:16","slug":"startup-cybersecurity-success","status":"publish","type":"resource","link":"https:\/\/trustarc.com\/resource\/startup-cybersecurity-success\/","title":{"rendered":"A Digestible Action Plan for Startups\u2019 Cybersecurity Success"},"content":{"rendered":"\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t\tArticles<\/strong>\n\t\t\t\t\t\t\t\t\t\t

A Digestible Action Plan for Startups\u2019 Cybersecurity Success<\/h1>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\n\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\"\"\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\tAnnie Greenley-Giudici<\/strong>\n\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/span>\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

It\u2019s never too early for a start-up business to strategize and operationalize its cybersecurity goals\u2013in fact, it\u2019s a prerequisite for high-yield growth. And yet, with all the high-velocity activity and rapid decision-making that characterizes most startups\u2019 early existence, it can be easy to overlook some of the critical proactive steps that must be taken to safeguard a growing company\u2019s value potential.<\/p>\n

The importance of this cannot be overstated. The harm to a startup\u2019s reputation and brand name can be existential if proper controls are not in place. A recent Forbes CommunityVoice\u00a0article<\/a>\u00a0by start-up founder Isaac Kohen offers some helpful starting points for businesses of all sizes to keep in mind. The major takeaways are summarized below, with additional perspectives added.<\/p>\n

Growing a cybersecurity culture from day one<\/h2>\n

A critical reminder for all is that cybersecurity is not at heart an infrastructure issue\u2014it\u2019s a cultural one. Most data-related incidents and lapses actually occur as a result of unintentional employee actions or an organization\u2019s nonchalant approach to protecting personal data and intellectual property.<\/p>\n

To combat the establishment of lax norms identify privacy and cybersecurity champions within each group first. Next, incentivize and make the training and reinforcement that goes into building a cybersecurity culture fun.<\/p>\n

Elevating accountability as a key attribute<\/h2>\n

Talk is cheap. Without proper follow-through being met at each level of an organization, the best laid cybersecurity plans will topple like a house of cards. This can involve performance metrics, enforced policies (such as no \u201cbring-your-own-device\u201d or taking company computers to public outings where loss is more likely to occur), discussions in managerial reviews, and even employee monitoring\u2013if done carefully, transparently, and respectfully.<\/p>\n

Such employee oversight is generally performed via monitoring software. This software often restricts data collection to specific, data-centric applications, enables auto-redaction and masking of personal data, and is inclusive of all employees. Include founders and management to set the proper top-down tone.<\/p>\n

It\u2019s not only good business \u2013 It\u2019s the law<\/h2>\n

As TrustArc customers are already aware, most data protection regulations around the world impose security requirements on organizations. Meaning that these costs should be expected and built into overall compliance and IT budgets. This is certainly the case with respect to startup businesses seeking to operate in or target products and services to European Union audiences thanks to the GDPR<\/a>. But it\u2019s also the case in an increasing number of Asian, African and South American nations as well.<\/p>\n

Moreover, the United States already has a number of industry-specific federal laws with security obligations (such as HIPAA<\/a>, FCRA, GLBA<\/a> and an alphabet soup of other regulations). And states like California and others are now passing their own privacy laws. Consequently, proper cybersecurity practices must be a fact of life for all companies going forward.<\/p>\n

Training and best practices are the way to go<\/h2>\n

Technology and threat vectors evolve, and so too should the measures a startup business takes to thwart such external threats. Team members need to be able to recognize, understand and know who\/what\/where\/when\/how to escalate an issue. That said, it is not necessary to reinvent the wheel on all things.<\/p>\n

From a U.S. perspective, which can in many cases be leveraged towards compliance with other major frameworks around the world, the Federal Trade Commission has released resources that provide a blueprint for startups. Examples of this include the FTC\u2019s 2015\u00a0Start With Security: A Guide for Business<\/em>\u00a0page<\/a>, which was followed in 2017 with the\u00a0Stick With Security<\/em>\u00a0blog series.<\/a>\u00a0Both resources provide data security-related guidance, examples, and best practices for small, mid-sized, and even enterprise businesses.<\/p>\n

In all, start early, have a plan and document your steps, develop a multi-stakeholder approach to privacy and cybersecurity, imbed accountability throughout\u2013then add water and watch your business grow.<\/p>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\t

\n\t\t\t\t
\n\t\t\t\t\tFollow us<\/strong>\n\t\t\t\t\t
\n\t\t\t\t\t\t\"\"<\/a>\n\t\t\t\t\t\t\"\"<\/a>\n\t\t\t\t\t\t\"\"<\/a>\n\t\t\t\t\t\tLink Copied!<\/span>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\tKey Topics<\/strong>\n\t\t\t\t\t\t