1. InfoSecurity Compliance Are you ready to be regulated? Presented by: Umesh Verma CEO, BLUE LANCE 02.26.04

2. InfoSecurity -Are you ready? Does your company process electronic protected health information (EPHI)? HIPAA Subtitle F; 45 CFR (Parts 160, 162, 164) Does your company receive and process protected personal information (PPI)/financial data that belongs to individuals? GLBA Title V - Privacy; 12 CFR Part 30 and other CFRs Can the FBI review your company’s business records, including electronic computer records as part of the effort to fight terrorism? USA Patriot Act Sections 215

3. InfoSecurity -Are you ready? Does your company submit data electronically to the Food and Drug Administration? FDA Modernization Act of 1997 21 CFR Part 11 Does your company process personal data that belongs to individuals that are citizens of any country in the European Union? Directive 95/46/EC Article 17 Does your company process certain types of unencrypted personal information belonging to California Citizens? SB 1386 Does your company process information belonging to an agency or department in the Federal Government? FISMA Sections 302 and 303

4. Is your company a financial institution that is required by the Federal Reserve to maintain capital reserves? Does your company have a published privacy policy or have made public proclamations about the quality of your information security? Is your company an outside service provider/vendor that processes “protected data” belonging to a regulated client? Federal Trade Commission Act Section 5(a) Any of the above. BASEL II Section V InfoSecurity -Are you ready? Is your company a public company, have ambitions to become a public company or are you a public accounting firm? Sarbanes Oxley Act of 2002 Sections 302 and 404

5. Business Impact? Will the immaturity of your infosecurity practices impact your ability to do business? –Are you directly or indirectly regulated? –What future regulatory changes are forthcoming? Do you recognize an emerging “cultural trend”? Can you afford to wait for an “enforcement action” before being motivated to make a needed investment in security? –Will you have enough time to act, when action is needed?

6. Business Impact? Are you willing to lose business opportunities by failing to pass a “due diligence” review? Can you withstand a public disclosure that your internal security has been compromised? Do you have the resources to implement an effective infosecurity practice? –People; Money; Tools; Knowledge –Are you able to meet the spirit of ISO 17799? Policy, Procedures, Baseline Security,...

7. Compliance Strategies Consider outsourcing opportunities to experienced practitioners –Information Technology Services (Tier 1, Tier 2) –Information Security Services When necessary and cost-justified, roll your own security –Implementing an internal Information Security Practice –Professionally managed – Ideally CISSP managed Hybrid strategies – more likely for most organizations –Because there is much to do as per ISO 17799 –You cannot outsource all infosecurity processing Dealing with application specific information access requirements.