Source: http://www.compliancelawjournal.com/compliancelawjournal/issue_1?pg=60
Timestamp: 2019-04-21 11:16:48+00:00

Document:
The foregoing required safeguards are surely beneficial aspects of any robust cybersecurity program, but they largely focus on operations, as opposed to mandates specifically targeted at preventing an external breach. For example, the rules might encourage an entity to allocate just enough resources to IT security which are necessary to track who is accessing the information, when it was accessed, and for what purpose; but such measures will do nothing to prevent unauthorized access in the first place from cyber criminals, whose methods are constantly changing. Further, general compliance practices and basic technical protections such as data backups are already prevalent. As the “addressable” measures set forth below illustrate, nothing in the rules requires serious and uniform ( i.e., industry-wide) investment in administrative cybersecurity measures, even for measures widely-used in other industries that can be understood by laypersons throughout the organization.
49. Id. § 164.308(a)( 7)( ii)( A)–( C) (2013).
50. Id. § 164.308(a)( 2) (2013).
51. Id. § 164.308(a)( 5)( ii)( B) (2013).
52. Id. § 164.308(a)( 5)( ii)( C) (2013).
53. Id. § 164.308(a)( 5)( ii)(D) (2013).
54. Id. § 164.308(a)( 7)( ii)(D) (2013).
55. Id. § 164.308(a)( 7)( ii)(E) (2013).
56. Id. § 164.310(a)( 1) (2013).

References: § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164