The Accredited Standards Committee X9 Inc. (X9) has published a new standard, “Financial and Personal Data Protection and Breach Notification.” X9.141 is a two-part document addressing both the “before” data protection and the “after” breach notification. Significantly, the standard complements and expands upon important National Institute of Standards and Technology (NIST) material, and it covers all sensitive data, both financial and non-financial. Both parts are available for download, separately or together.

Data security breaches continue to put millions of consumers, as well as businesses, their employees and other stakeholders, at risk. Protecting internal business and consumer information is a shared responsibility for all parties involved, including legacy and cloud service providers, organizations that store, transmit or process sensitive information, financial institutions, business employees and individual consumers.

The new standard clearly defines requirements for data protection and breach notification for the financial services industry. It is also applicable to all organizations, in any industry, that handle sensitive personal information, and its adoption will be a solid step toward building robust defenses against both sophisticated cyber-criminals and everyday data thieves.

“A highlight of X9.141 is that it is aligned with the business information security controls contained in the NIST Cybersecurity and Privacy Frameworks,” said X9 Executive Director Steve Stevens. “This outcome greatly facilitates an organization’s compliance efforts. Together with the NIST documents, X9.141 lays out a clear path for a business to follow in addressing its data protection needs.”

X9.141 “Part 1: Data Protection” provides requirements and recommendations for the protection of data in the financial services industry. It is based on a special NIST publication, which was chosen for compatibility with prevailing security and privacy assessments within other industries. It also cross-references certain other NIST, International Organization for Standardization (ISO) and X9 standards.

X9.141 “Part 2: Breach Notification” builds on Part 1 and takes into account U.S. federal and state privacy laws. It offers a consistent breach notification process to protect and inform consumers and other stakeholders nationwide, including requirements and comprehensive recommendations.

“A clear need for a data protection and breach notification standard has been recognized for years by major industry groups. In a joint letter to Congress in 2017, seven organizations called for one strong national standard for all personal data, whether financial or non-financial in nature, eliminating the current inconsistent patchwork of laws. X9.141 is the realization of that goal,” said Alan Thiemann, an attorney and partner with Han Santos, PLLC and general counsel for Conexxus.

Thiemann further stated, “It is critical that a business, whether a financial institution or any other industry entity, be able to focus its compliance resources on a single uniform standard for protecting all personal data, from consumer/payment data to personal information of employees, job applicants, vendors or suppliers.”

Similar to Notcoin - TapSwap on Solana Airdrops In 2024

origin »

193 +