The document discusses compliance regulations and best practices for staying compliant. It outlines several key compliance regulations including PCI, HIPAA, GLBA, SOX, and FISMA. It discusses the goals and requirements of these regulations, including securing data, data retention, and audit trails. The document presents the four pillars of compliance as business continuity, data security, data retention, and audit trails. It compares compliance requirements to internal expectations and outlines best practices like encryption, frequent backups, quick recovery times, and regular testing to meet both. Finally, it introduces the Quorum Recover Everything solution as a way to meet compliance demands and infrastructure needs with features like long term retention, encryption, offsite replication, and testing capabilities.

1. Presented by Jason Snook @Quorum
Staying out of the
Crosshairs

2. Background on your speaker
You’ll find me either geeking out on tech, riding in
the woods, or keeping up with two boys.
Jason Snook
Jason.snook@quorum.net
Systems Engineer

3. Agenda
What Compliance Regulations
are actually demanding
Pillars of Compliance
Compliance VS Internal
Best Practices for both

4. Regulations and Compliance – What we hear
PCI – Credit card information security - applies to ANY organization, regardless of size or number of
transactions, that accepts, transmits or stores any cardholder data.
HIPAA – Requires healthcare organizations to implement secure electronic access to health data and to
remain in compliance with privacy regulations set by HHS.
GLBA – Regulates the collection and disclosure of private financial information; stipulates that financial
institutions must implement security programs to protect such information; prohibits accessing private
information using false pretenses
Sarbanes-Oxley (SOX) – Designed to combat corporate fraud through stringent accounting, auditing and
financial disclosure regulations
FISMA – Defines a comprehensive framework to protect government information, operations and assets
against natural or man-made threats.
FINRA – Non-governmental financial industry watchdog; Self-Regulatory Organization (SRO)

5. Regulations and Compliance – What we hear
Goal: Bank and commerce act to standardized hold and deposit rules
How: Mandates DR of information
More How: Secure data storage
Goal: Keep patient data private
How: Encrypt, processes, secure transactions, audit and control
More How: System availability of EHR, meaningful use of secure EHR, backup DR plan
Goal: Ensure reliability of North American power
How: Backup and DR is at the top, physical security of cyber systems, security MGMT
More How: vulnerability assessments, impact considerations

6. Regulations and Compliance – What we hear
Goal: Identify shortcomings in governments approach
to ensuring cyber security
How: Conducts research on current risk assessments.
From a terror state perspective.
More How: Offers guidance about DR planning, audit,
data retention, secure data storage, etc…
GAO-17-440T
Government controls that dwarf most US regulations
A form of class action against companies who loose
personal information. Who’s affected?
• Data Processors as well as data controllers
• Anyone company with an establishment in the EU
• Companies outside the EU that do business with EU
residents

7. $5.5M
Advocate Health
receives largest
HIPAA fine ever
Hippajournal.com
$13.3M Genesco fined for
data breach (PCI)
Threatpost.com
The high costof non-compliance
2016 was a banner year for paying for compliance
$14.4M
Various
corporations –
failure to protect
records (FINRA)
finra.org
$1.6M Ashley Madison
(originally
$17.5M) (PCI)
theguardian.com

8. The 4 pillars of Compliance
Business
Continuity Data Security Data Retention Audit Trail
Data must be
available
during a crisis
Data must be
protected
against breach
Data must be
recalled
Who accessed or
changed what
data when?

9. Uptime
Companies need
to keep systems
and data available
Compliance VS Internal Expectations
Business
Continuity
Compliance demandsyou keep systems and
data available
Data
Security
Data integrityis a core tenantof many
compliance regulations
Data
Retention
Regulationsdemand you keephistorical data for
years for future retrieval
Audit SecurityandDR testingcan be a mandatedpart
of the auditprocess
Compliance and Regulations Infrastructure Demands
Companies need
to keep systems
and data available
Security
Infrastructure needs
a way around
Ransomware and
other security events
Testing
DR testing is a
must have and
must do

10. Best Practices Staying compliant while meeting expectations
ONE
Protect integrity by
demanding encrypted
storage and long term
retention
Three
Archiving should be
part of BDR. Either
local or remote
retention options.
Two
Demand quick RTO
while using frequent
backup points. Don’t
forget to consider
recovery performance
Four
Always be testing.
Pass your audits by
leveraging thorough
DR testing.

11. Protect All from loss or downtime
Fast RTO, short RPO, and amazing RPE
Meet Compliance+ InfrastructureDemands
Long term retention is native
Encryption in motion and at rest
Boot from any retention point
Offsite replication is standard

12. Introducing
Recover Everything
Simple and Fast
Physical or Virtual
Applications and Data
Local HA and Offsite DR or DRaaS
Encryption and rest AND in motion
Native archiving solution
Unlimited local and DR testing

14. Technically speaking
404 Series
5-10 TBs
64-384 GB RAM
22-32 TBs
128-768 GB RAM
420 Series
32-50 TBs
256-768 GB RAM
424 Series
400 TBs
512-2048 GB RAM
**Storage and IO scale independently
onQ POD
All appliances feature:
400 GB NVMe
10GB Networking
5 to 400TB’s
4x24 Hardware Support

15. Quorum RADAR
Unified Interface
Heat Map
Server Cards
Rolling Events
Workload Tagging

16. Thank You!
Jason Snook | Jason.Snook@Quorum.net | 541-349-2183