Author: ARRC Technology

With all the rules and regulations surrounding the compliance alphabet soup in play today, it will take more than one person to bring your company in line. We’ve laid out the multiple roles needed to up your compliance game, especially when it comes to HIPAA, PCI, and GDPR.

IT Team

Your first line of defense against compliance failures is the technology in use and the team you have to maintain it. Consult with your IT team to discuss:

• Email Encryption: How are emails and files that go in and out of your office protected to avoid nefarious hands and revealing identifying information?
• Data Encryption: How do you collect and retain credit card information? Are there any gaps where that information could be stored or released in an identifiable way?
• Firewall: Are you protecting your company data and communications using a screen door that is easily opened by hackers, or are you using a multi-level security system preventing intrusions?
• Backups: How often, when and where is your precious company information backed up? Can you test your backups to prove that they’re effective? Is your current backup plan compliant with regards to customer data?
• Data Availability and Storage: Who has access to your data? Only certain individuals in your company should be able to access all data, like financial records or payment information. How are you restricting access on your network or within line of business applications to ensure safety?
• Physical Access: Who can actually access computer systems and servers? Do you train your staff to lock their systems every time they leave their desks? Are you using privacy filters on appropriate screens to avoid wandering eyes?

Internal Compliance Officer

While this may not need to be a full-time role within your organization, you should have a compliance champion on staff. Your IT company can absolutely set you up for success, but they are not around to police your staff every hour of the workday.

The Compliance Officer is responsible for ensuring that your staff follows important compliance policies, maintains vigilance surrounding compliance, keeps documentation up to date, and works with authorities if necessary. Specifically, they:

• Watch for employees falling into bad habits, like leaving computers unlocked or sending credit card data willy-nilly throughout the organization.
• Conduct/coordinate online or in-person training to keep compliance top of mind. We recommend quarterly training, at least, in addition to proper education as soon as a new employee comes on board.
• Maintain all the documentation required for compliance, like backup plans and communication standards.
• Liaison with federal and state regulators, as necessary to prevent or mitigate an issue (with the support of your IT Team and legal team).

All Employees

You can have the best technology, the most intense compliance officer, and still completely fail at successful compliance if your employees are not onboard. At the end of the day, it comes down to successful employee implementation and clear communication. In order to get employee buy-in, here is what we recommend:

• Gather everyone together: When you first make tweaks to your company’s security protocols to ensure compliance, explain why to your team. If they suddenly all need to remember 16-character passwords, replace those passwords every 90 days and have 5-minute time outs on their systems; they’d appreciate learning it’s not because you’re paranoid. You can utilize your IT Team to conduct this meeting.
• Send regular reminders: It’s simple to fall into what’s “easier” rather than compliant. Consider sending a weekly or monthly compliance tip to all of your staff to keep it top of mind.
• Conduct ongoing trainings: These trainings should be mandatory, involve your IT team, and vary enough to stay interesting. Quarterly should be sufficient unless some regulation change calls for additional meetings.
• Multi-departmental planning: Different teams have different uses for data. For example, what makes the salesperson tick may make it impossible for accounting to operate within compliance. When it comes to collecting information that must be compliant, every department must be involved in process development to create smooth operation within rules and regulations.

Compliance is not a one-man game. It involves the whole company and IT team engagement to really be successful. Next blog, we’ll cover the processes necessary to build a compliance-friendly environment.

In 2018, the European Union enacted a new directive to protect its citizens from having their personal information stolen or sold known as GDPR or General Data Protection Regulation. This legislation protects EU citizens, but in reality, it is a global law at this point. Any businesses in the world that mishandle the personal information of an EU citizen, including something as simple as improperly tracking a cookie on your website, could be fined for non-compliance. Those fines are not cheap. A company failing to comply with the regulation could be subject to a 4 percent forfeiture of its annual revenue. In its first year, there were 95,000 complaints from Data Protection Authorities all over the EU. It’s here to stay, so should you care? 

 

Of the 95,000 complaints received, telemarketing, promotional e-mails, and video surveillance were the top culprits. So far, three fines were issued by DPAs for GDPR violations. The largest fine issued was in the sum of €50,000,000 for lack of consent to processing personal data. Compliance is no joke and it can be tricky to implement. 50% of all businesses still have not migrated into the world of GDPR compliance, though they know it could end in litigation. This carries over for American companies that either employ EU citizens or service them. Even though your business is in the states, you can still get fined from across the pond.  

 

The main idea behind GDPR is protecting citizens and consumer rights. Not only are businesses held responsible for storing people’s information, but they are also held accountable if any misuse occurs to that information. If data is hacked, that business is obligated to report it within 72 hours of the breach and give a detailed account of the data that was stolen. In addition, under GDPR, citizens can request to have their information taken out of data storage, and a business must comply.  

 

Currently, social media networks and automated email services are the heaviest hit by GDPR. Facebook has seen a steady decline in European consumers. Also, it has cracked down on how people can use FB ads when targeting certain audiences. Email marketing has seen an increase of opt-outs and tighter spam regulations, changing the marketing game for many companies.  

 

In order to become compliant with GDPR, you will need to first appoint someone as your DPO, or data protection officer. This person will be the point of contact and GDPR expert. They’ll need to be able to handle IT services as well as monitor all the data handling processes in your company. Then, of course, they’ll need to be able to consistently monitor any area that may be impacted by GDPR and ensure they’re within compliance. It is highly recommended that the DPO goes through thorough training on the subject so they know exactly what to look for when it comes to staying compliant. 

 

GDPR is great at protecting citizens, and most professionals believe it’s only a matter of time before the United States adopts similar regulations. It’s always better to be prepared, so perhaps it’s time to look into GDPR compliance. 

Even though ransomware attacks decreased in 2018, they remain a major threat in the cybersecurity landscape. So much so, that ransomware was recently featured on 60 Minutes. The story primarily covers three major instances of ransomware, two that affected municipalities, and a third that targeted a hospital. 

All three were attacked in a way that encrypted every single one of their files and also encrypted some of the files within their backups, sending the organizations back to operating on pen and paper. Two, despite FBI recommendations, ended up paying the ransom to restore their data quickly, while the third decided not to pay the ransom and went about remediation on their own.  

The hospital was hit with a $55,000 bill, while one municipality (Leeds, AL) was able to negotiate the payment down to $8,000. These ransom sums may not appear astronomically high, but that’s exactly how the hackers keep going. If they requested millions in ransom, no one would pay. An amount in the solid five-figures, though, feels doable for most organizations to get their precious data restored. The third entity (Atlanta, GA) suffered millions of dollars in losses and time in efforts to recover. Some of their data could never be recovered. 

The story presented a very clear picture of the dangers surrounding ransomware; however, there were two major issues in the story. First, the entities covered were obviously major entities implying that you needed to be in the public eye to be affected. This is certainly not the case. In fact, nearly 50% of small business owners say their business was affected by a cybersecurity attack in the last year. Ransomware is not just for highly public entities.  

Perhaps more importantly, the story painted paying the ransom as the cheaper and often faster way to go. In very rare occasions, paying the ransom is the only option; but if you’re stuck in a ransomware trap, we do not recommend jumping straight into paying the ransom. Here’s why: 

1. 1. Sure, after you pay the sum (typically in bitcoin), the vast majority of hackers suddenly become ethical and return your files. Let’s look at the reality, though. You’re relying on someone who just took your data hostage for an exorbitant fee to return that data to working order simply because you held up your end of the unwanted bargain. Sounds a lot like using hope as a data recovery strategy to us. At any point the hacker could respond, “Thanks, but no thanks!” or “Well, we thought this would be a sufficient amount”; but we ran into snags with your recovery. We’ll actually need x number to finish the job.” 
   2. Prevention is a better strategy. If your back-up is set up correctly with an on-premises and multi-tenant off-site solution, you should be able to roll back to data that existed before the ransomware attack. Granted, you may lose some data in the process if the encryption gets into the backup like it did in the attacks covered in the 60 Minutes story. Losing some data is a lot better than putting yourselves up the creek financially by paying a major ransom. In addition to proper backup, ensure that you’re effectively training employees and stringently monitoring data coming in and out of your network.
   3. Isolation is possible. In short, don’t store all of your valuable data in one place. If, on the off-chance, ransomware breaches your network, you don’t want to give it an open door to encrypt absolutely everything of value. Keep all critical applications on isolated networks to maintain global network safety.

Ransomware attacks may be on the decline. However, that just invites the hackers to come up with a more creative way to scam you out of time and money. Perhaps phone ransoms are coming next. Regardless of what the hackers create, make sure you’re prepared and don’t have to rely on paying a hefty ransom to keep your business in operation. 

No matter what industry you’re in, compliance acronyms are abundant, filling your days with both confusion and regulation. We call it the compliance alphabet soup. It’s time to make a little bit more sense of all those acronyms and what they likely mean for your business. 

GDPR (General Data Protection Regulation): While this regulation only applies to the European Union and information leaving the EU, we are seeing its effects state-side because it requires businesses that interact with EU citizens to comply, regardless of location. The goal of GDPR is to create greater data privacy and protect from breaches. If there is even the slightest likelihood that someone from the EU will be visiting your site or interacting with you online, make sure that you comply with GDPR regulations. We’ll cover GDPR in greater detail in our next blog.  

HIPAA (Health Insurance Portability and Accountability Act of 1996): While this law has been on the books since 1996, many medical practices are still not HIPAA compliant and believe that they are too small to be touched. Even if you aren’t directly in the medical industry, pay attention! Beyond the practices themselves, any organization that works with a medical practice has responsibility in HIPAA compliance through associate agreements. These agreements particularly apply to IT companies, law practices, accounting firms, and others that might have access to patient data in any way. Bottom line, all patient data must be protected, encrypted, and safe. You also need to have a specific HIPAA-compliance plan, breach response plans, and data recovery methodology. HIPAA has gained notoriety with larger scale medical breaches in recent years, in addition to larger fines levied for HIPAA breaches. The largest fine currently on record is $16 million. Small companies are also being hit with violations costing about $1.5 million apiece.     

HITECH (Health Information Technology and Clinical Health Act): HITECH entered the picture in 2009 and brought teeth to HIPAA violations. This regulation specifically covers the electronic transmission of health information. In its best form, it’s meant to improve patient care through better doctor coordination, better sharing of information, and strong data security of electronic health records. In practice, all those privacy forms that you sign whenever you go to the doctor really do have an important purpose.  

I-9 (Employment Eligibility Verification): This is the form that new hires must fill out within three days of employment to verify that they are eligible to work within the US. While this piece of paper may get lost among the sea of new hire paperwork, it should never be overlooked. Even if you’ve been correctly employing the I-9 form for years, you may want to go back and check for form updates. Some updates will have no impact; but to be truly in compliance, you’ll sometimes need to go back and have every employee update their I-9 information and verification documents.  

PCI DSS (Payment Card Industry Data Security Standard): Do you collect credit card information within your business? Any payment data collected and stored must be PCI compliant. To ensure compliance: 

• Employ strong security standards, like firewalls, anti-virus protection, and regular updates that protect your network as a whole 
• Encrypt all credit card information transmitted across open networks 
• Maintain strong data access controls to ensure that rogue people don’t gain access to your information   

These are just a few of the compliance acronyms you may encounter in your daily work. Don’t get lost in the compliance alphabet soup. A quality IT firm can help you comply with the vast majority of these and will be able to put a clear plan of action in place to increase your cybersecurity footprint.  

In most zombie movies, there is no antidote. No cure for their nasty zombie virus, it’s simply all downhill from there…You watch as they slowing begin to turn into the “working dead”. After the same-old, same old, day in and day out, your team quickly begins looking a lot like zombies. Soon your productivity has slowed down, along with your sense of adventure, and finally, it’s all over. The sparkle and excitement drain from your employees’ eyes as they mindlessly do their job. Obviously, no one wants a zombie, both in the horror sense and the work sense. Here are a few things that will help keep your employees immune to the virus.  

 

First of all, remember that a positive workplace is key to great employee morale. Positivity isn’t a slew of awesome perks, though that is nice. Positivity is the energy derived from the respect people have for one another. It’s also having trust in people and allowing them to speak freely about their issues. Often, bad employee morale is caused by a feeling of being defeated. It’s the hypocrisy that can often rear its ugly head in the corporate world. My motto is always to treat everyone as you would want to be treated. That’s a pretty good start for a more positive and productive workplace.                  

 

To piggyback off that, it’s also wonderful when leadership engages with employees. Yes, you’re busy, and yes you pay them so in your mind that should be enough. Well, you’d be surprised at how many people sincerely care about your business alongside that paycheck. The ones that do feel respected and engaged with the company when leadership even gives a simple hello while passing in the hallway. Spend a little personal time getting to know people and engaging with your employees. This will allow them to feel that much more connected to your business and be motivated to take care of it correctly.    

 

Then, of course, there is recognition. This is always a tough one because many business owners and bosses alike feel as though a paycheck is enough recognition. In a perfect world, it certainly would be. Today’s workforce requires a little butt patting. (Not literally, don’t do that!) What I mean is a simple thank you can be an immense boost to someone’s ego. If a few simple words increase productivity, then why the heck not? No one is asking for crazy bonuses, free lunch, or a gym membership. (Although, I’m sure you wouldn’t get turned down for that). Employees just need to know they are working in the right direction and are producing quality. Ultimately, they want to make you happy and your business succeed.  

 

The main takeaway here is to put some genuine care into your employees. Foster an environment where people can speak up about the good, bad, and ugly without negative repercussions. Mostly though, treat others as you would want to be treated and that will create the baseline for your success. 

Unfortunately, the majority of the workforce are unengaged. Rather than work, disengaged employees are usually spending their days socializing, surfing the internet, shopping online, and possibly even job hunting. Many of the reasons for this include a lack of challenging work, too many work hours, and feelings of dissatisfaction. It really is unfortunate because employees simply want a positive environment where they can do their best work. Not only that but low engagement costs United States companies over $350 billion in revenue every year. The amount is staggering but there are several signs that you may want to look out for when it comes to employee engagement.  

1. Quiet 

The first sign is if the employee suddenly withdraws. Some employees have a quiet and shy nature, so be aware of that before you jump to conclusions. However, it is important to keep an eye on disengaged employees over time. If you notice an employee suddenly get quiet and withdraw for a few days, you may have a problem.  

2. Decrease in Quality 

Next is a drop in the quality of work that the employee was producing. Many times, you can notice employees taking longer to complete assignments or simply producing less. If the lack of quality is consistent, you most likely have a disengaged employee. Sometimes though, a brief period of underperformance is possible due to work and life stress. However, if it’s continual it means your employee is starting to care less.  

3. Behavior 

Another more obvious way of seeing that your employees are disengaged is if you see an attitude or anger. If an employee is visibly upset or even lashing out on managers or co-workers, it is not a good sign. This could be because the employee is having issues within the workplace that need to be addressed. Or simply they are unhappy with their current job.  

4. Over Socializing 

Too much socializing could also be a sign of disengagement. If your employees are constantly wandering around the office or gossiping at the water cooler, that is a sign that they are bored and they are trying to get away from their desks. By doing this they are avoiding their responsibilities and contributing to a lack of productivity.  

5. Avoidance  

When an employee avoids coworkers or work-related events its yet another sign of disengagement. Sometimes, people don’t enjoy the social aspects of work life and that’s okay. But if an employee took part in these things before and is recently showing avoidance, it most likely points to disengagement.  

6. Tardiness 

Tardiness and leaving work early are more signs that an employee is lacking at their job. Sometimes it is necessary to come late or leave early, life does throw curveballs every once in a while. But if it is occurring often and/or affecting work, it is yet another sign. You will want to communicate with your employees to ensure there aren’t any outside forces affecting their tardiness.    

7. Sick Often 

Finally, overusing sick days is a sign of disengaged employees. People do get sick or have doctor appointments, so there should be some kind of leeway. But you know when the use of sick leave becomes excessive, or employees begin to abuse it. Long weekends are usually a sign of this. 

Once you’ve discovered one or more of these things happening it suggested you communicate with your employee and try to understand if there is an underlying reason to be disengaged. However, you do have to ask yourself if that team member is worth saving in the first place. Will their attitude drag down other employees? Will work continue to lack quality? Does the employee even know if something is abnormal? Once you make your decision, work on keeping the rest of your workforce engaged. Recognizing them for their work is always a welcomed idea. If you find out how to motivate them, it will help boost morale and in turn re-engage complacent employees. 

There is a saying that goes “people don’t quit their jobs, they quit their bosses.” We’ve found this to be true, especially as we talk with front line employees about the challenges they’re experiencing with technology. Now, it doesn’t usually become an outright complain fest about the failures of management, but we’ve noticed these nine things that tie poor job morale with lackluster management.

Not in Touch with Their Struggles

It’s the everyday frustrations. Having a single monitor. Waiting for their computer to load. Lack of storage. Systems crashing. A line of business application that stays constantly in the whirligig of waiting. These are things that all front line employees experience, but aren’t usually passed through the management ranks. Why? Let’s face it. Management have the best systems, the quickest support, and (usually) the least hands-on involvement in line of business applications. Good managers recognize these challenges, and either provide enough time to deal with them or mitigate them with regular refreshes or improvements. If you don’t, you’re going to continually drain your employees’ energy, create frustration, and leave them longing for a more efficient day to day.

Lack of Communication

As a manager have you ever spent hours in a meeting making important decisions and then just expected that your employees understand what happened out of osmosis? Maybe you’re too tired to pass on the information and then get lost in the next item on your to-do list. Maybe you assume that they should already know what’s going on. Lack of communication is a quick ticket to frustration. Every time you make a decision, make sure you have a clear path to inform your teams, whether it’s a daily huddle, a summary email, or a classic memo.

Vague Direction

Not communicating is one thing. Giving vague instructions and then expecting your team to deliver exactly what you envision is another equally painful result of poor management. Instead, make sure you’re clearly documenting your vision. We utilize Basecamp and Trello for this purpose, ensuring that our teams receive the message and have enough detail to take action. Beyond the written word, make sure you’re touching base with your team daily on progress, questions, and areas requiring support.

Micromanagement

The opposite of vague direction is micromanagement. No one wants to be monitored constantly, especially in a job that they know like the back of their hand. Put the systems in play where you can manage key performance indicators, job performance, and time sucks (like restrictions on how long people can spend on Facebook during their workday), then let your people do their work.

Taking Credit/Not Giving Credit Where It’s Due

After your employees complete their work, make sure you give them credit. This is the number one reason people hate their bosses. Whether it’s an email or meeting shout-out, give your people their gold stars. It will go a long way toward maintaining employee engagement.

Lack of Advocacy

If your employees bring you a problem, i.e. their systems aren’t performing properly, software is making their lives unbearable, they spend half their time fixing the copy machine rather than doing their day job, do something about it. If you don’t have someone to help you with these challenges, start looking for someone who can, like a full managed services company. Get their challenges taken care of so everyone can get back to work.

Consistent Overwork

While any good employee understands that they may need to put in some extra hours from time to time, make sure you set certain work expectations from the beginning, and hold tight to those expectations. If you do need someone to burn the candle at both ends, at least acknowledge their extra effort.

Not Using Strengths

Each person brings unique skills to the job. Take the time to get to know your employee’s strengths and make sure you’re utilizing them. Granted, everyone is going to have to do their fair share of busy work every once in a while, but the more you can throw them a bone with a task clearly within their zone of passion, the happier they will be.

No Path to Growth

Dead-end jobs lead to zombie employees and a lot of resentment. Make sure you have clear roadmaps in play that drive your employee’s growth and they understand expectations and benchmarks.

In some situations, an employee may just not get along with their boss. Most often, though, the misstep falls amongst one of these nine issues. As such, they are fairly easy to alleviate with the right technology, communication skills, and clear direction driven by the proper managerial motivation.

You’re ready to purchase a BDR. You’ve done all of the research, found a company you’re confident in and are excited to finally have peace of mind. But now you start thinking about exactly what you need to back up. Is all of your data necessary or should you salvage a little server room? All businesses want to back up everything, you never know when you’ll need it. It’s not always necessary to back up everything daily, but there are some you will want to consider.  

 

Depending on what kind of BDR you purchased you will first need to delegate what data is stored, is not stored, and how often. Notice that there are three different kinds of backup in today’s tech world. Those are; straight to cloud services, software-based products, and a hybrid approach that combines on-site hardware and software. By segmenting the market, you can quickly assess which approach will work best. Ideally, you will want to spend money on a company that specialized in a backup. However, keep in mind that the faster the solution is and the more automated, the more expensive it will be.

 

Don’t feel bad if you went a little cheap in order to save money. You can still backup without automation or any third party, you will just need to remain diligent about it. If you are making sure to do a daily backup there are several business items you want to account for each day. First is credit card transactions or receipts. Your accounting software should keep an eye on this and automatically back this data up, but you can never be too sure. This also includes things like invoicing, receivables, payroll and just about anything that is financially related. All financials are incredibly important, even one lost invoice could really hurt your business.  

 

Next, you will want to backup any client files. Anything with hackable data or items that could be compromised need to be backed up daily as well. Not only is it invaluable to keep this information safe, but it would certainly affect your client confidence if anything was lost or stolen. Finally, we must backup any project management software. Anything that your business uses to keep track of daily activities and work being done needs backup. Just like financial software, usually, project management software will also back up and recover items if lost. But once again, that’s a chance you don’t really want to take. Then, of course, it affects communications, so you don’t want to want to maintain a log of communication or “paper trail” as people day. 

 

You want to keep all of these things intact. Not only your precious memories but also the really important stuff that your clients and customers trust from you. Keep these items in mind and you should never have to deal with business killing disaster.