reading time: 14 minute(s)

It’s first thing in the morning, and you’re checking a customer’s payment information for an order just to realize something’s not right… It’s been changed, and no one on your team altered it. Was it a mistake, or did someone gain unauthorized access? Now, you have to figure out what happened.

This scenario is all too common and can lead to reputational damage, legal issues, and compliance concerns — but data security also isn’t always easy to understand. The terminology is complex and confusing, yet it’s also the key to understanding how your business’s sensitive data is protected.

Let’s take a look at some common terms you should be familiar with.

What Are Compliance Terms?

They can refer to the standards, frameworks, regulations, and independent assessments that establish requirements or provide information about how organizations manage security, privacy, and data protection.

SOC 2

System and Organization Controls 2 evaluates controls relevant to the AICPA’s Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Security is required, while the other categories may be included as applicable.

There are also two types of SOC 2 reports. Type I evaluates the design and implementation of controls at a specified point in time, while Type II also evaluates their operating effectiveness over a specified period.

Why it matters: A SOC 2 report provides independent information to help you evaluate a service provider’s controls before trusting them with sensitive data. 

HIPAA

The Health Insurance Portability and Accountability Act Privacy Rule protects certain individually identifiable health information, while the Security Rule requires covered entities and business associates to use administrative, physical, and technical safeguards to protect electronic protected health information (ePHI).

Why it matters: Businesses that handle protected health information should understand whether HIPAA applies to them and what requirements they may need to follow. 

PCI DSS

The Payment Card Industry Data Security Standard is a set of 12 broad security requirements for organizations that store, process, or transmit card data. 

These requirements are designed to meet 6 primary objectives:

• Test and monitor networks regularly 
• Strong access control measure implementation
• Information security policy maintenance
• Vulnerability management program maintenance
• Cardholder data protection
• Secure network and system building and maintenance

Why it matters: Businesses that accept or process payment cards need to understand their responsibilities for protecting cardholder data. 

What Are System Security Terms?

They describe the actual technologies, processes, and controls used to protect data and systems from cybersecurity threats. Think of it as the practical methods used to protect data and support security and compliance efforts.

Data Encryption

A method of converting sensitive data from a readable format to an encoded form that requires the appropriate cryptographic key, a set of mathematical values, to read. 

There are two common encryption key methods:

• Symmetric: The encoding key is the same as the decoding key.
• Asymmetric: A public and private key pair that are paired together but not identical, with the private key used only by the owner and the public key shared with recipients. 

Why it matters: Encryption helps make sensitive data unreadable to anyone who accesses it without the appropriate key, enhancing security. 

Access Controls

Rules that determine who can access particular systems, information, or functions and when they can do so. 

Common access control models include:

• Discretionary access control (DAC): Every object has an owner who grants access at their discretion.
• Role-based access control (RBAC): Access is granted based on business functions.
• Mandatory access control (MAC): A central authority regulates and organizes access rights into tiers, with access granted based on clearance level.
• Attribute-based access control (ABAC): Access is determined by environmental conditions and attributes, such as location and time.

Why it matters: Strong access controls help prevent employees, vendors, or attackers from accessing information they aren’t authorized to use. 

MFA

Multi-factor authentication requires two or more different authentication factors to access an account, such as:

• Something you know (a password)
• Something you have (an authentication app or security key)
• Something you are (a fingerprint)

Why it matters: MFA adds an additional barrier against unauthorized access when a password is compromised. 

Penetration Testing

An authorized security exercise where a cybersecurity expert tries to exploit and find vulnerabilities within a system. This is a method for identifying weak points before an attacker does, providing time to fix them.

Why it matters: It can reveal weaknesses before malicious attackers can exploit them. 

Conclusion

You don’t need to be a cybersecurity expert to make smarter decisions about your business’s data. Understanding terms like SOC 2, encryption, access controls, and MFA can help you recognize the protections your business uses and ask better questions when evaluating the companies you trust with sensitive information.

Curious about how TaxBandits handles data security? Learn about how we safeguard your data on our security webpage.