To add to the confusion, it seems like everyone and their mother claims to have an easy to follow recipe, off the shelf solution, or quick guide to HIPAA compliance and data breach protection success! Well, we can tell you first hand that there are no quick and easy solutions to achieving and maintaining HIPAA compliance but there are some premier FREE services that will help you get there. One free service, in particular, is invaluable: the U.S. Department of Homeland Security (DHS), National Cybersecurity Assessments and Technical Services (NCATS) team. The DHS NCATS team will conduct a whole host of cybersecurity threat assessments as well as conduct an on-site visit free of charge. These are experts in the field of digital and internet security are at your disposal and the comprehensive report findings remain confidential so that you can complete a comprehensive remediation action plan to address any negative findings. Scroll down to the section titled How do I Request a Free Cybersecurity Risk Assessment for details on how to start the process. For a list of other free resources please visit and read our Resources page.

If you prefer completing a self-assessment there is an excellent resource from Carnegie Mellon’s Software Engineering Institute titled Mapping the HIPAA Security Rule to the Cyber Resilience Review. The article on mapping and how organizations can use the CRR alongside the HIPAA Security Rule is an excellent resource providing a detailed explanation of the process. Keep in mind that the CRR self assessment tool is very comprehensive and not for the faint of heart…

How Do I Request a Free Cybersecurity Risk Assessment?

The short and sweet answer: Send an email to ncats_info@hq.dhs.gov requesting a cybersecurity risk assessment.

The NCATS team will respond  within 24 business hours assigning a ticket number to your request. The NCATS team response will include details on how to engage their team, a sample risk assessment report, and the rules of engagement.

If you would like help from our team in understanding how to navigate HIPAA compliance, protect against data breach, implement mobile device management, install and use DriveStrike Remote Wipe and Data Breach Protection services – please send us an email at support@drivestrike.com. To signup for DriveStrike please select Sign Up from the menu or if you want to learn more about DriveStrike pricing please select Pricing from the menu.

DriveStrike Remote Wipe

Data Breach Protection

Remote Wipe Pricing

Best Remote Wipe Solution

Best Remote Wipe

GDPR Remote Wipe

GDPR Solution

GDPR Compliance Solutions

GDPR Compliance

NCCoE is a collaborative effort where industry experts, government agencies, and academic institutions work together to address businesses’ most pressing cybersecurity challenges.

The Spearstone team joined the NCCoE team to help define and drive standardization and data security best practices. At Spearstone we are committed to delivering the best device and data security solutions possible at reasonable prices while providing exceptional customer service and reliability.

With the enormous growth in mobile computing devices, IoT, data inter-connectivity, and general data availability it is vital that authorized IT administrators implement and maintain control over those devices and the data which reside in them and are accessible by them. The surface area and number of attack vectors increases exponentially with each device that can access sensitive data and the requirement to protect against unauthorized data access necessitates Remote Wipe solutions so that when a device is lost or stolen the organization can quickly and easily contain the data breach risk.

We are proud to be an active member of the National Cybersecurity Center of Excellence Community and are actively engaged in helping to define and implement valuable solutions that protect devices and data anywhere and everywhere.

The public-private partnership with NCCoE enables the creation of practical cybersecurity solutions for specific industries or broad, cross-sector technology challenges. Working with technology partners—from Fortune 50 market leaders to smaller companies specializing in IT security— the NCCoE develops modular, easily adaptable example cybersecurity solutions demonstrating how to apply standards and best practices using commercially available technology. The NCCoE documents these example solutions in the NIST Special Publication 1800 series, which maps capabilities to the NIST Cyber Security Framework and details the steps needed for another entity to recreate the example solution. The NCCoE was established in 2012 by NIST in partnership with the State of Maryland and Montgomery County, Md.

We encourage you to review the NIST NCCoE standards and examples, they are an excellent free resource that can give your organization a clear and sustainable competitive advantage in cyber defense.

If you would like to learn more about NCCoE or have questions on how you can start protecting your mobile devices with DriveStrike please call us at any time or email us at info@spearstone.com .

To start protecting your mobile devices with DriveStrike Remote Wipe, Lock, and Locate – please signup for our 7 day free trial.

Below are examples of mobile device management policies, you can find a downloadable template and instructions of each of these on our Resources page:

Mobile Device Acceptable Use Policy

Purpose

This policy defines standards, procedures, and restrictions for any and all end users with legitimate business uses connecting mobile devices to [company name]’s corporate network, digital resources, and data. The mobile device policy applies, but is not limited to, all devices and accompanying media that fit the following classifications:

• Smartphones
• Other mobile/cellular phones
• Tablets
• E-readers
• Portable media devices
• Portable gaming devices
• Laptop/notebook/ultrabook computers
• Wearable computing devices
• Any other mobile device capable of storing corporate data and connecting to a network

In order to enforce security and remote device management, only devices that meet the following criteria are allowed to access corporate resources:

• Smartphones, tablets, and other devices running Android version 2.3 (Gingerbread) and higher.
• Smartphones and tablets running iOS 5.0 and higher.
• Laptops running Windows 7 and higher
• Laptops running Mac OS X Cheetah (10.0) and higher

The policy applies to any mobile device that is used to access corporate resources, whether the device is owned by the user or by the organization.

The primary goal of this policy is to protect the integrity of the confidential client and business data that resides within [company name]’s technology infrastructure, including internal and external cloud services. This policy intends to prevent this data from being deliberately or inadvertently stored insecurely on a mobile device or carried over an insecure network where it could potentially be accessed by unauthorized resources. A breach of this type may result in loss of information, damage to critical applications, loss of revenue, damage the company’s public image, breach our data privacy requirements, and violate data privacy laws. Therefore, all employees, contractors, or personnel using a mobile device connected to [company name]’s corporate network, and/or capable of backing up, storing, or otherwise accessing corporate data of any type, must adhere to company-defined processes and policies in doing so.

Applicability

This policy applies to all [company name] employees, including full and part-time staff, contractors, freelancers, and other agents who use any mobile device to access, store, backup, or relocate any organization or client-specific data. Such access to this confidential data is a privilege, not a right, and forms the basis of the trust [company name] has built with its clients, supply chain partners, and other constituents. Consequently, employment at [company name] does not automatically guarantee the initial or ongoing ability to use these devices to gain access to corporate networks and information.

The policy addresses a range of threats to enterprise data, or related to its use, such as:

Addition of new hardware, software, and/or related components to provide additional mobile device connectivity will be managed at the sole discretion of our IT group. Unauthorized use of mobile devices to back up, store, and otherwise access any company-related data is strictly forbidden.

This policy is complementary to any previously implemented policies dealing specifically with data access, data storage, data movement, and connectivity of devices to any element of the company network and resources.

Responsibilities

The [title, example: HIPAA Security Officer] of [company name] has the overall responsibility for the confidentiality, integrity, and availability of corporate data.

The [title, example: HIPAA Security Officer] of [company name] has delegated the execution and maintenance of information technology and information systems to the [title, example CIO].

Other staff under the direction of the [title, example: CIO] are responsible for following the procedures and policies within information technology and information systems.

All [company name] employees are responsible to act in accordance with company policies and procedures.

Affected Technology

Connectivity of all mobile devices will be centrally managed by [company name]’s IT department and will use authentication and strong encryption measures. Although IT will not directly manage personal devices purchased by employees, end users are expected to adhere to the same security protocols when connected to non-corporate equipment. Failure to do so will result in immediate suspension of all network access privileges so as to protect the company’s infrastructure.

Policy & Appropriate Use

It is the responsibility of any [company name] employee using a mobile device to access corporate resources to ensure that all security protocols normally used in the management of data on conventional storage infrastructure are also applied here. It is imperative that any mobile device that is used to conduct [company name] business be used appropriately, responsibly, and ethically. Failure to do so will result in immediate suspension of that user’s account. Based on this requirement, the following rules must be observed:

Access Control

1. IT reserves the right to refuse, by physical and non-physical means, the ability to connect mobile devices to corporate and corporate-connected infrastructure. IT will engage in such action if such equipment is being used in a way that puts the company’s systems, data, users, and clients at risk.
2. Prior to initial use on the corporate network or related infrastructure, all mobile devices must be approved by IT. [Company name] will maintain a list of approved mobile devices and related software applications and utilities, and it will be stored at [file location or URL]. Devices that are not on this list may not be connected to corporate infrastructure. If your preferred device does not appear on this list, contact the helpdesk at [e-mail address] or [phone number]. Although IT currently only allows listed devices to be connected to enterprise infrastructure, it reserves the right to update this list in the future.
3. End users who wish to connect such devices to non-corporate network infrastructure to gain access to enterprise data must employ, for their devices and related infrastructure, security measures deemed necessary by the IT department. Enterprise data is not to be accessed on any hardware that fails to meet [company name]’s established enterprise IT security standards.
4. All personal mobile devices attempting to connect to the corporate network through the Internet will be inspected by [company name]’s IT department. Devices that are not approved by IT, are not in compliance with IT’s security policies, or represent any threat to the corporate network or data will not be allowed to connect. Devices may only access the corporate network and data through the Internet using a Secure Socket Layer (SSL) Virtual Private Network (VPN) connection. The SSL VPN portal web address will be provided to users as required. Smart mobile devices such as smartphones, tablets, and laptops will access the corporate network and data using mobile VPN software installed on the device by IT.

Mobile Device Management (MDM)

1. [Company name]’s IT department uses the [DriveStrike] mobile device management solution to secure mobile devices and enforce policies remotely. Before connecting a mobile device to corporate resources, the device must be set to be manageable by [DriveStrike].
2. [DriveStrike]’s client application must be installed on any mobile devices connecting to corporate resources. Even personal devices owned by employees must have the [DriveStrike] installed. The application can be installed by contacting the IT department.
3. The mobile device management solution enables IT to take the following actions on mobile devices: [remote wipe, location tracking, remote lock].
4. Any attempt to contravene or bypass the mobile device management implementation will result in immediate disconnection from all corporate resources, and there may be additional consequences in accordance with [company name]’s overarching security policy.

Security

1. Employees using mobile devices and related software for network and data access will, without exception, use secure data management procedures. All mobile devices must be protected by a strong password; a PIN is not sufficient. All data stored on the device must be encrypted using strong encryption. See [company name]’s password and encryption policy at [file location or URL] for additional background. Employees agree never to disclose their passwords to anyone.
2. All users of mobile devices must employ reasonable physical security measures. End users are expected to secure all such devices against being lost or stolen, whether or not they are actually in use and/or being carried.
3. Any non-corporate computers used to synchronize or backup data on mobile devices will have installed up-to-date anti-virus and anti-malware software deemed necessary by [company name]’s IT department.
4. Passwords and other confidential data, as defined by [company name]’s IT department, are not to be stored unencrypted on mobile devices.
5. Any mobile device that is being used to store or access [company name] data must adhere to the authentication requirements of [company name]’s IT department. In addition, all hardware security configurations must be pre-approved by [company name]’s IT department before any enterprise data-carrying device can be connected to the corporate network.
6. IT will manage security policies, network, application, and data access centrally using whatever technology solutions it deems suitable. Any attempt to contravene or bypass that security implementation will be deemed an intrusion attempt and will be dealt with in accordance with [company name]’s overarching security policy.
7. Employees, contractors, and temporary staff accessing [company name] internet resources from a smartphone or tablet will NOT save their user credentials or internet sessions when logging in or accessing company resources of any kind.
8. Employees, contractors, and temporary staff will follow all enterprise-sanctioned data removal procedures to permanently erase company-specific data from such devices once its use is no longer required.
9. In the event of a lost or stolen mobile device, the user is required to report the incident to IT immediately. The device will be remotely wiped of all data and locked to prevent access by anyone other than IT. If the device is recovered, it can be submitted to IT for re-provisioning. The remote wipe will destroy all data on the device, whether it is related to company business or personal. The [company name] Remote Wipe Waiver, which ensures that the user understands that personal data may be erased in the rare event of a security breach, must be agreed to before connecting the device to corporate resources.
10. Usage of location-based services and mobile check-in services, which use GPS capabilities to share real-time user location with external parties, is prohibited within the workplace.
11. Usage of a mobile device to capture images, video, or audio, whether native to the device or through third-party applications, is prohibited within the workplace.
12. Applications that are not approved by IT are not to be used within the workplace or in conjunction with corporate data.

Hardware& Support

1. IT reserves the right, through policy enforcement and any other means it deems necessary, to limit the ability of end users to transfer data to and from specific resources on the enterprise network.
2. Users will make no modifications to the hardware or software that change the nature of the device in a significant way (e.g. replacing or overriding the operating system, jail-breaking, rooting) without the express approval of [company name]’s IT department.
3. IT will support the connection of mobile devices to corporate resources. On personally owned devices, IT will not support hardware issues or non-corporate applications. See [file location or URL] for full help desk and tech support policies.

Organizational Protocol

1. IT can and will establish audit trails, which will be accessed, published, and used without notice. Such trails will be able to track the attachment of an external device to the corporate network, and the resulting reports may be used for investigation of possible breaches and/or misuse. The end user agrees to and accepts that his or her access and/or connection to [company name]’s networks may be monitored to record dates, times, duration of access, etc. in order to identify unusual usage patterns or other suspicious activity. The status of the device, including location, IP address, Serial Number, IMEI, may also be monitored. This monitoring is necessary in order to identify accounts/computers that may have been compromised by external parties or users who are not complying with [company name]’s policies.
2. The end user agrees to immediately report to his/her manager and [company name]’s IT department any incident or suspected incidents of unauthorized data access, data loss, and/or disclosure of company resources, databases, networks, etc.
3. [Company name] [will/will not] reimburse employees if they choose to purchase their own mobile devices. Users [will/will not] be allowed to expense mobile network usage costs. Reimbursement details are available at [file location or URL].
4. Every mobile device user will be entitled and expected to attend a training session about this policy. While a mobile device user will not be granted access to corporate resources using a mobile device without accepting the terms and conditions of this policy, employees are entitled to decline signing this policy if they do not understand the policy or are uncomfortable with its contents.
5. Any questions relating to this policy should be directed to [name] in IT, at [phone number] or [email address]. A copy of this policy, and related policies and procedures, can be found at [file location or URL].

Policy Non-Compliance

Failure to comply with the Mobile Device Acceptable Use Policy may, at the full discretion of the organization, result in the suspension of any or all technology use and connectivity privileges, disciplinary action, and possibly termination of employment.

The (i) HIPAA Security Officer, (ii) Chief Operating Officer, and (iii) immediate manager or director will be advised of breaches of this policy and will be responsible for appropriate remedial action.

Employee Declaration

I, [employee name], have read and understand the above Mobile Device Acceptable Use Policy, and consent to adhere to the rules outlined therein.

___________________________________                              _______________________________

Employee Signature                                                                                         Date

___________________________________                              _______________________________

Manager Signature                                                                                           Date

___________________________________                              _______________________________

IT Administrator Signature                                                                              Date

Mobile Device Remote Wipe Waiver

Purpose

This waiver defines remote wipe technology and ensures that employees understand and agree to its use in the event that a remote wipe is necessary. This waiver is to be read with, and signed in conjunction with the [company name] Mobile Device Acceptable Use Policy.

The overriding goal of this policy is to protect the integrity of [company name’s] data, as outlined in the [company name] Mobile Device Acceptable Use Policy. Therefore, all users employing a mobile device that connects to [company name] network, and/or is capable of backing up, storing, or otherwise accessing data of any type, must agree to this remote wipe waiver.

Applicability

This waiver applies to the same devices and users outlined in the [company name] Mobile Device Acceptable Use Policy. The waiver only applies to devices that are utilized to access [company name] resources.

Remote Wipe

By connecting to [company name] technology resources, mobile devices gain the capability of being wiped remotely by [company name] IT department.

When a remote wipe is initiated by the user or the IT department, the user’s mobile device will be wiped of all data and settings. Wiping data, documents, files, settings, and applications in the event a device is lost, stolen, or compromised in any way is critical to protecting our company and its constituents.

If a user requests a remote wipe all data stored on that device will be deleted. A user can later restore personal date from a personal (e.g. from a user’s personal computer or from a cloud service to which the user subscribes). It is recommended that users backup their personal data frequently to minimize loss if a remote wipe is necessary.

A remote wipe will only be initiated if IT deems it appropriate. Examples of situations requiring remote wipe include, but are not limited to:

• Device is lost, stolen or believed to be compromised
• Device is found to be non-compliant with company policy
• Device inspection is not granted in accordance with company policy
• Device belongs to a user that no longer has a working relationship with [company name].
• The user decides they no longer wish to participate in accordance with Mobile Device Acceptable Use Policy.
• Termination of employment in which the user has not already cleared all [company name] data by another method approved by IT.

Employee Declaration

I, [employee name], have read and understand the above Mobile Device Remote Wipe Waiver, and consent to have my device wiped if the IT department deems it necessary. I further hold [company name] harmless and absolved of any and all liability that arises from or in connection with remote wipe, remote lock, or remote locate on my personal or provisioned device.

___________________________________                              _______________________________

Employee Signature                                                                                         Date

___________________________________                              _______________________________

Manager Signature                                                                                           Date

___________________________________                              _______________________________

IT Administrator Signature                                                                             Date

Remote Wipe

The fastest most powerful drive wipe in the industry. DriveStrike sanitizes data and wipes not only your main drive but all secondary connected drives on the protected device. Spearstone patented our remote wipe solution in 2008 and serves thousands of customers across nearly every industry.

Remote Lock

Lock your device remotely on demand. Set a lock PIN on MacOS devices and empower your administrators with DriveStrike.

Remote Locate

DriveStrike goes beyond an IP lookup. We leverage all available geo-location assets including WiFi triangulation. You can initiate a locate at anytime from the DirveStrike device page to get the last device fix. DriveStrike requests location updates on a regular basis so you can track the historical location of any protected device.

Built By Experts

We weren’t satisfied with just making a good data and device protection service…so we decided to do something different. We reached out to many of the top business and security minds of today to ask them about things like ease of deployment, cross platform support, critical functions for data protection, and more. DriveStrike is the culmination of over a dozen of the smartest engineers on the planet who shared their expertise to build into this truly ultimate data protection platform. You can learn more about the DriveStrike at our website.

Simply The Best

Don’t just take our word for it. See for yourself. First time users frequently report how intuitive and easy DriveStrike is to deploy and use. We often receive praise for our world-class live support and service!