Certainly this "reasonable safeguards" benchmark is open to interpretation. The good news is this benchmark accounts for the fact that no security system is invincible. The bad news is that if you've failed to review how your benefits office handles PII, identify risks, mitigate those risks, educate your employees, etc., a reasonable individual will find that you did not put in place reasonable safeguards to secure PII. Doing nothing is not an option.
As the writer points out, most information loss comes from humans, not faulty machines, and most of that is non-malicious, just plain old human error.
No comments:
Post a Comment