Compliancemanagementforbeginners

What is compliance?
Compliance simply means adhering to laws, health and safety standards, or data and security
requirements.

Sounds simple, right?
But wait.
Due to the specific nature of your organization, ‘compliance’ could mean a very different thing for you
than the school down the street or the hospital across town. That’s why each organization should design
its own compliance standards, and design systems for ensuring that your network of staff is able toadhere to them.

There are a few different types of regulation that
require a compliance plan:• Legal regulations, such as anti-discrimination, anti-slavery andanti-corruption laws
• Industry standards, such as quality standards or privacy standards• Security, such as keeping a physical location safe, ensuring control
over devices and maintaining data privacy• Organization-determined rules and responsibilities, such asenvironmental impact or conduct requirements for vendors.

W h at i scompliance?
In each of these types of compliance areas, every organization must consider
the impact on the organization as a legal entity; the impact on staff; and theimpact on students, patients or customers.

And each industry has its own set of legal
regulations, standards and security needs
such as:• Healthcare organizations must follow HIPAA• Higher education institutions must adhere to FERPA• Financial institutions must closely follow FDIC rules andregulations• Governmental institutions must adhere to FIPS (FederalInformation Processing Standards) and ensure that thethree classification categories remain sacrosanct.
That’s a great deal to consider and keep track of!
But it’s also absolutely vital.

W h at c a n h a p p e n w h e n
c o m pa n i e s i g n o r ecompliance?
We don’t have to guess at what can happen; we have examples all around us,
every day, of:• Data breaches• Loss of customers, accounts or jobs

• Data leakage• Loss of reputation• Monetary loss: fines or settlements

Here are just three examples that made international news:
global retailer allowed 110 million customer’s credit and debit card information to be
1. Astolen
due to a vulnerability in a third-party app. Their reputation suffered greatly, andthey paid $18.5 million in damages.
large, well-known professional networking site paid a $1.25 million settlement for
2. Apassword
leaking, and then more recently had a data leak of more than 700 million
users’ data, due to a vulnerability in its API. This impacted their reputation negatively
and will likely cost them money as well.
large social networks, one in China and one in the US, had data breaches affecting
3. Two
538 million and 533 million users respectively, exposing more than a billion email
addresses and phone numbers.
In all of these cases, proper compliance procedures could have stopped theseproblems before they happened.

W h at i scompliancemanagement?
Compliance management is, well, how you manage yourcompliance.
It’s the policies and procedures your organization enacts in order to ensure compliance in all areas,
it’s the digital tools you use to ensure compliance and — perhaps most importantly — it is the people
who make sure that all of it gets done.
These tools, people and processes work to detect compliance violations, which protects yourorganization from these violations — and potential disaster.

Cyber Essentials and Jamf
When the UK’s National Cyber Security Centre issued its
Cyber Essentials scheme, organizations wishing to meet thenew requirements turned to Jamf for help in implementing them.
Learn More

H ow c a n I g e t s ta r t e dwith compliancemanagement in myo r g a n i z at i o n ?
All of this can be overwhelming, but as with any large task you break down thelarger pieces into smaller ones, and you ask for help.

Here are some steps to follow that should
get you off on the right foot.
buy-in. Your organization must be all on board for an effective
1. Ensurecompliance management system, and it must be from right at thetop. Collect together a group of people who can enact these newprocesses throughout the entirety of your organization.
Take stock of the entire compliance landscape for your organization:
each type of regulation, regulations specific to your industry and how
these safeguards will protect your organization, staff and clients.
a risk assessment. Assessing your risks will lead you to
2. Conduct
the right compliance management. The whole point of compliancemanagement is, ultimately, to reduce risk. Take a look at all of yoursystems: your physical plant, your ethical and legal safeguards, yourdigital landscape.
a policy audit. Subjecting any existing policies to close
3. Conduct
scrutiny with your new risk assessment can expose any places where
you need to make updates.

H ow c a n I g e t s ta r t e dwith compliancemanagement in myo r g a n i z at i o n ?

Here are some steps to follow that should
get you off on the right foot. (continued)
Ensure that all staff understand why compliance is
4. Educate.
important, their place within the policy structures and how they canand must contribute to keeping your organization secure.
this is never a ‘set it and forget it.’ Put systems,
5. Understandsoftware and auditing procedures in place to continually evaluate
your risk, your adherence to regulations and where possible gaps
in your system might arise. Equip yourself with automated reporting,verification auditing systems and clear sight lines to any possible
problem areas.
everybody accountable. Continually educate and also follow
6. Keepup. If necessary, include clear disciplinary guidelines for those whodamage your compliance and ensure that your compliance in all areas
is actively and consistently enforced.

Our wheelhouse: device and IT security management
There are so many pieces to track in the compliance puzzle, and no more so than in information
technology and digital security.

Compliance iscomplicatedbut Jamf
can help.

We offer assistance with:

And here’s how we do it:• CIS Benchmarks• With Apple inventory, identity and app lifecycle management.

• DISA-STIG• With log aggregation, a central system of records and SIEM

• NIST 800-171• With encryption, threat defense and risk scoring for both iOS,
macOS and the apps you use on them

• CMMC (A new set of cybersecurity standards developedby the Department of Defense, the Cybersecurity Maturity
Model Certification program, created to protect defense
contractors from cyber attacks.)• macOS Security Compliance Project• With strong data policies and continual data leakage
monitoring
But most importantly, we do it with our world-class support andextensive knowledge of the Apple landscape, and with our sinceredesire to ensure that every organization succeeds with Apple.

Contact us to understand how
Jamf can help your organizationand try it for free.

Request trial
Or contact your preferredApple reseller to get started.