Protecting the privacy of employee and customer data has become increasingly more difficult for corporations.   LexisNexis has taken an industry leadership position in terms of ensuring data privacy. A few members of the LexisNexis team took time yesterday to share some of the company’s best practices on building its Security, Privacy, and Compliance Framework on an IMF Web Forum.   A few key points from the presentation are included below.

Why are privacy, security, and compliance important?  LexisNexis believes they are important for a number of reasons, including information security breaches that are a global, industry-wide problem. In addition, implementing a strong privacy, information security, and compliance framework into an organization will positively impact the brand, market share, risk mitigation, customers, and employees.

LexisNexis has made security part of its business model.  They encourage organizations to put a framework in writing, make it clear, and always adhere to its guidelines. 

Here are some things to consider when putting a framework in place: 1) complete an inventory of information assets with personally identifiable information; 2) evaluate data security, credentialing, and all policies, standards, and guidelines; 3) most importantly factor in audit and compliance.  Additionally, make sure your framework is process driven with a quarterly application inventory, risk assessments, and audit programs (both internal and third party). 

LexisNexis also addressed the steps to ensure data security.  Some examples included: updating inventory on a regular basis; codifying the collection, use, and dissemination of PII/SPII in policies; restricting/limiting third party access; encrypting all sensitive data both in transit and at rest; and taking advantage of password assessments.

Last but certainly not, LexisNexis places an emphasis on educating and training its employees on the guidelines, use, and privacy of sensitive data.  There is annual mandatory training for employees. Taking it one step further, regular privacy, security, and compliance-related communications are distributed via the intranet and email, among other methods.