A Roadmap To “Reasonable” Cyber Protection

A report issued by the attorney general of California defines what constitutes minimum standards of “reasonable security” for personal information held by organizations subject to California’s security statute. Summarized in this post from Ballard Spahr, it could be a useful guide for any enterprise that holds potentially problematic information. A good place to start, says the report, is a set of procedures known as the SANS Top 20. The AG’s report also remind’s data managers that when it comes to data protection, there are a few basics that go a long way. One of them is to limit the personal information collected and retained in the first place. You can’t suffer a breach of data that you don’t have.