ISO/HIPPA Development & Analysis

An NSA ISO/HIPPA Development compliance program provides structured methodology designed to help companies build comprehensive and cost effective enterprise security programs, ensuring that security resources are applied wisely, and efforts are focused on activities that will reduce real business risk.

NSA's ISO/HIPPA Developmentservices provide a risk based approach to help organizations comply with the HIPAA Privacy and Security Rules. An NSA risk assessment and HIPAA/HITECH along with an ISO verification gap analysis will:

• Establish a model for the adoption of an annual security risk management program,
• Identify gaps in your security controls designed to protect ePHI,
• Provide a Roadmap to Security and Compliance (RSC) or a Corrective Action Plan (CAP) to correct deficiencies,
• Enable healthcare executives to develop budgets to support implementation of the CAP and instill a mindset for continuously monitoring security and compliance, and provide the services of a Solutions Architect to guide the implementation of the plan.

HIPAA Compliance Program

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires covered entities to comply with what is commonly known as the Privacy Rule and the Security Rule.

NSA's HIPAA Compliance Program includes services to help our clients expeditiously and cost effectively progress through the entire compliance life-cycle and address the requirements published by the Department of Health and Human Services. Specifically, NSA assists its clients in preparing for the required ongoing HIPAA reviews, conducting the reviews in a collegial, rather than adversarial manner, documenting compliance with the rules, and providing a HIPAA Compliance Statement that describes the scope of HIPAA compliance activities and level of compliance achieved.HIPAAreviews cover:

• Administrative safeguards
• Physical safeguards
• Technical safeguards
• Organizational requirements
• Policies, procedures, and documentation requirement

ISO Compliance Program

For years, organizations have been searching for an objective benchmark to measure the security of potential business partners and to distinguish the quality of their own services. ISO is an international standard that defines an overarching security framework consisting of 135 specific controls organized around 36 control objectives. This balanced framework serves as the basis for both measuring an organization's effectiveness in addressing risk and structuring an organization's overall security program. Because ISO requirements are largely a superset of other major regulations, achieving ISO compliance positions most organizations to be well on their way to meeting the requirements of Sarbanes Oxley, Gramm-Leach-Bliley, HIPAA, and other pertinent regulations.

NSA's ISO Compliance Program provides the following:

• Encourages organizations to develop a security program that integrates business and technology
• Helps to identify and prioritize specific tasks to improve security and achieve compliance
• Focuses on activities that reduce real business risk
• Positions companies to meet the security requirements of Sarbanes Oxley, Gramm-Leach-Bliley, HIPAA, and other pertinent regulations
• Improves cross-functional (e.g. Legal, HR, lines of business) cooperation on security matters
• Identifies deficiencies in security areas that are often overlooked
• Encourages organizations to develop a balanced view of security that includes secure business processes, well designed policies, and appropriate use of technology
• Communicates to prospective customers, business partners, board members, employees, and regulators that the organization has a comprehensive security program in place

PCI Compliance Program

NSA is a Qualified Security Assessor Company (QSAC) and its staff members are recognized as Qualified Security Assessors by the Payment Card Industry (PCI) Security Standards Council. The PCI Security Standards Council's QSA qualification requirements are exacting and detailed, involving both the security company and individual employees. The organization was founded by American Express, Discover Financial Services, JCB, MasterCard Worldwide, and Visa International to enhance payment account data security. NSA's PCI Compliance Program includes services to help our clients expeditiously and cost effectively progress through the entire compliance life-cycle. These services include:

• Helping our clients to understand the PCI Data Security Standard compliance requirements as it applies specifically to their business
• Assisting Level 2-4 merchants prepare for and complete the Annual Self Assessment Questionnaire
• Working with acquirers to determine specific merchant requirements
• Assisting Level 1 merchants and Service Providers prepare for the PCI DSS annual on site review
• Conducting annual on site reviews
• Recommending practical measures to address any compliance deficiencies
• Assisting in remediation efforts