Talk to them about what security protocols they use (Secure Sockets Layer – SSL – or Transport Layer Security – TLS) to see if they are using the most recent protocols. Ask if their protocols follow those recommended by the National Institute of Standards and Technology (NIST). For example, those outlined in the Federal Information Processing Standards Publication (FIPS 140-2).

How do you protect data at rest?

It's not enough to protect data only when it's moving; stored data needs to be protected as well. Are providers encrypting your stored data? What algorithms are they using to do so? Are they state-of-the-art? Are their systems protected by firewalls, anti-virus programs and intrusion-detection/prevention measures?

Who at your company has access to company data?

Make sure these employees are trained on security best practices and the importance of protecting PII. Also ask about internal measures in place to make sure employees who don't need access can't easily get it.

Are your policies in accordance with Sarbanes-Oxley and Gramm-Leach-Bliley?

These acts came about in response to corporate fraud in the financial services industry. While not explicitly about data security, some aspects touch on internal measures to protect consumer information. You'll want to make sure what your provider has in place is compliant with these acts.

What other security standards and guidelines do you adhere to?

There are a number of security guidelines that exist in specific industries, along with state, national and international guidelines (e.g., ISO 27001). Talk to your providers and be sure that any industry and government-guidelines the company follows are also followed by them.

Do you use two-factor authentication for administrative log-ins?

The ability to add another level of security at log-in will decrease the risk of accounts being breached. Ask your provider if they have a dual-factor authentication option that includes confirmation of identity through an SMS text, app or push notification before allowing users access to their accounts.

Instant Insights /

7 cybersecurity questions to help protect your clients' data

More From HR Executive

Related Stories

Recommended For You