Data Privacy
Your clients are under pressure from state and federal privacy laws, and most small businesses do not have the expertise to keep up. As an MSP, you can be the trusted guide. BCSS gives you a white label data privacy program that includes policies, controls, and data mapping. You get the tools and expertise to help clients understand where they fall short and close those gaps with a prioritized plan. This makes you look bigger, keeps you sticky with clients in regulated industries, and helps you expand into new markets with confidence.
What to do?
Get a handle on the data
(Who, What, Where, When and How)
- Types of Data Processed/Stored
- Data Classification
- Regions (Subjects and Storage)
- Methods of processing/storage
- Third Parties Involved?
Basis of Processing
- Why does data processing occur?
- What does the privacy policy/notice say?
- What do contracts (if any) say?
General Security Review
- Vendor Management
- Asset Inventories
- Incident Response
- Revamp of Privacy Policy Updates must be done annually due to changing legislation
- Privacy Program Documentation
- Contract/Agreement Review/Revision
- Opt-out options (CCPA)
- Data Breach Requirements must be embedded into an Incident Response
Where to start? Get an Assessment
Start by offering your clients a baseline data privacy assessment under your brand. BCSS provides the framework, documentation, and automated discovery so you can deliver results without adding staff. The audit highlights risks in both technology and process, giving you a roadmap for remediation. You stay in control of the client relationship while we provide the expertise behind the scenes. With predictable billing and no long term contracts, you can scale up or down as needed.
The audit will cover the following functions and areas :
Business Environment
- Identify and document geographic regions, privacy regulations and system locations.
Inventory and Data Classification
- Data Storage / Encryption Requirements
- Data Flows
- Vendors
- Systems
- Data Classifications
Data Protection
- Review protection controls, processes and policies
- Align data classifications with protections
Policies, Processes and Procedures
- Incident Response Plan
- Privacy Policy and Notices
- Data Destruction
- Physical Security
- Third Party Management
- Data Subject Requests
Awareness and Training
- Privacy Training within Security Awareness.
Desired outcomes?
- Audit Report detailing current state in each core area and a gap analysis.
- Creation of a remediation plan and timeline
- Executive Summary providing a snapshot of the current situation for distribution to business leaders and committees.