One of the ways a U.S. based organization can transfer personal data from the E.U. back to the U.S. and meet the intent of the Directive is to comply with the Safe Harbor requirements. Complying with the Safe Harbor can be a very time consuming and arduous process. SecureState understands that most organizations do not have the dedicated personnel necessary to understand and build a privacy program that meets the conditions set forth by the Safe Harbor. As such, SecureState’s Project Management Services process aims to alleviate the difficulty associated with complying by utilizing a proven methodology to assist clients in navigating the Safe Harbor principles, and evaluating Safe Harbor compliance through a well thought-out, repeatable process.

SecureState CIPP Certified professionals will perform a GAP Assessment that can be used to:

• Self-Certify to the U.S. Department of Commerce your company has implemented the seven Safe Harbor principles and abided by any applicable FAQs and DPA advisories;
• Verify employees and customers have appropriate access to a Safe Harbor privacy policy that embodies the Safe Harbor requirements;
• Accept jurisdiction of the U.S. Federal Trade Commission (FTC) under section 5 of the Federal Trade Commission Act (which prohibits unfair or deceptive practices affecting commerce and allows for FTC sanctions);
• Implement policies, procedures, and controls to ensure that organizations that process personal data received from the E.U. and Switzerland are in compliance with the Safe Harbor requirements.
• Should material gaps exists, SecureState and work to build a roadmap to comply, before self-certifying with Department of Commerce.

SecureState’s EU SAFE HARBOR Gap Assessment/Pre-Audit approach maps critical information processes to determine if regulatory controls have business impact. The goals are to:

• Evaluate the effectiveness of your EU SAFE HARBOR compliance program
• Review EU SAFE HARBOR controls
• Remediation cost-justification

The stages of our EU SAFE HARBOR Gap Assessment/Pre-Audit, with limited descriptions, are as follows:

Onsite Visit:

• Introduce engagement participants and define roles
• Review engagement activities
• Review any applicable documentation

Process Mapping:

• Document the high level in-scope EU SAFE HARBOR systems and technical infrastructure

Requirements Analysis:

• Document the existing controls used to protect in-scope EU SAFE HARBOR Assets
• Identify gaps against the EU SAFE HARBOR requirements.

Reporting

• Outline strategic recommendations to mitigate identified control gaps
• Upload remediation activities to MyState Portal

• Provides comprehensive on-demand Privacy and Security expertise during the engagement and throughout the year
• Maintains close relationships with our clients because we care about the outcome of the assessment
• Supports its clients’ compliance program with our proprietary “MyState Portal” and a team of qualified security specialists
• Has worked with some of the top US financial institutions on EU Safe harbor compliance

• The Five Step Compliance Shuffle
• Data Privacy: an Oxymoron, Wishful Thinking, or Strategic Goal?
• Privacy Trends to Look for in 2012
• Information Security Assessments You've Never Had (But Should)

• Privacy Gap Assessment
• Network Architecture Review
• External Penetration Assessment
• Internal Penetration Assessment
• External Vulnerability Assessment
• Internal Vulnerability Assessment

 

• EU Directive Safe Harbor Gap Assessment – Pre Audit (PDF)