FAQs Archive - Alpha Records Management

Q: What is CSR Readiness

The CSR Readiness® Pro Edition comprises the risk assessment program CSR Readiness® and the awardwinning CSR Breach Reporting Service™ (BRS).

Q: How does the CSR Readiness® Program work?

CSR Readiness® Program is an online self-assessment tool that helps you review, revise and revisit your business processes for handling the personally identifiable information (PII) of your customers, employees and vendors as required by a host of legislation and regulations. CSR Readiness® 3 Step Process: 1) Review – Take a Self-Assessment Evaluation Detect location of personally identifiable information (PII) in an organization Determine how PII is: Acquired Accessed Handled Transmitted Stored Destroyed 2) Revise – Implement Readiness Policies and Remediation Instructions Remediate weaknesses and train employees on system-generated policies and procedures 3) Revisit – Continually Improve Risk Score Routinely monitor and audit performance to meet legal, regulatory and other compliance requirements A dashboard will show progress and generate tasks to improve compliance. You can improve your business risk scores by remediation and implementation of further program offerings. Upon successful completion of the analysis and remediation, your business will earn a Certificate of Completion and the ID Stay Safe Digital Seal that you can use on your website and advertising.

Q: What is ID Stay Safe?

Upon successful completion of the Readiness Program, users will earn a Certificate of Completion along with an ID Stay Safe digital seal to display on their company website. The seal remains valid for one year, at which time they will Revisit to ensure their business has sufficiently addressed any all changes that may have occurred throughout the year

Q: What does the Certificate of Completion signify?

Once a business has completed all the questions in the self-assessment evaluation and implemented the remediation tasks, you will be awarded the Certificate of Completion. This can be placed on your website and is valid for one year from date of issue. By annually revisiting your self-assessment, you can maintain this Certificate of Completion.

Q: What laws govern personally identifiable information?

Here are a few examples of the hundreds of laws and regulations that relate to the protection of personally identifiable information (PII) and requirements to report suspected or real loss: Gramm-Leach-Bliley Act (GLBA) Fair Credit Reporting Act (FCRA) Drivers Privacy Protection Act (DPPA) Drivers Privacy Protection Act (DPPA) Health Insurance Portability and Accountability Act (HIPAA) Health Information Technology for Economic Clinical Health (HITECH) Act Payment Card Industry Data Security Standard (PCI-DSS) Family Educational Rights and Privacy Act (FERPA) 47 state data breach laws

Q: What does CSR Breach Reporting Service do for me?

In the event of the actual or suspected breach of PII, the CSR Breach Reporting Service reports to authorities and notifies consumers, as required. Your call to the in-house CSR team of privacy professionals initiates a custom evaluation of your incident to determine if authorities and consumers must be notified. CSR files the necessary breach reports on your behalf, and consumer notification can be prepared with your input.

Q: Who are the enforcement agencies and others who might be involved after a breach?

Enforcement officials include various federal and state agencies as well as attorneys general, commissioners and others. Here are a few examples: Federal Trade Commission (FTC) Consumer Financial Protection Bureau (CFPB) Card brands like Visa, MasterCard, etc. State Attorneys General • Federal Bureau of Investigation (FBI) US Secret Service Dept. of Health and Human Services/Office of Civil Rights

Q: Why do businesses need Readiness Pro Edition?

Various state, federal and international laws require businesses to protect the personally identifiable information of employees, vendors and customers. Penalties for noncompliance can include fines, prosecution and even jail time. Massachusetts and Connecticut are just two examples of many jurisdictions that require businesses that deal with their residents maintain comprehensive risk assessment, remediation and monitoring programs related to their handling of legally protected personal information, known as PII.

Q: What if personally Identifiable information shared and/or received from another organization is compromised?

If your business is a third-party provider and has personally identifiable information on customers, employees, or vendors, then you may be required to notify authorities and/or consumers and others that a breach, or suspected breach, has occurred.

Q: If organizations don’t have this service, what could happen?

While it's impossible to completely avoid a breach due to uncontrollable circumstances, 97% could have been prevented. Accidents, errors and theft are just a few ways that information is compromised. Smart devices and wireless services compound the problem. Proactive detection and correction can go a long way to prevent loss and further fallout due to reputational damage, lost sales, fines, lawsuits and prosecution. The Department of Homeland Security, the FTC, Visa and the BBB encourage businesses to protect consumer data and plan ahead to reduce risk. All states have laws that protect their residents who might be your customers, employees or vendors. Many laws specifically require creation and maintenance of information security programs by businesses that employ or have customers who are residents of those states. These laws include penalties for noncompliance. For example, the civil penalty for violating the Connecticut Act No. 08-167, requiring safeguarding of personal data, is $500 per violation, up to $500,000 for a single event. Lost trust means lost sales. The fallout of data breaches has caused businesses to close their doors. According to Visa, businesses should “Consider a breach likely and plan accordingly.”