In this lesson,
we will learn about industry standards.
Industry standards are established guidelines
and practices that organizations
within a specific industry are expected to follow.
These standards are often developed by industry bodies
or regulatory organizations
and service benchmarks for compliance and best practices.
The industry standards that we will be discussing today are
the Payment Card Industry Data Security Standard,
or PCI-DSS,
the International Organization for Standardization/
International Electro Technical Commission,
or ISO/IEC 27000 Series,
which during this lesson,
we will just refer to as the ISO 27000 Series,
and the Digital Markets Act, or DMA.
In order to understand them each,
let's imagine a city where different safety measures ensure
everything runs smoothly.
PCI-DSS is like the security guards at the bank.
The security guards ensure
that every transaction is protected
and your financial details remain secure during purchases.
The ISO 27000 Series acts like the city's building codes,
setting the standards and guidelines
that businesses must follow
to ensure their data infrastructure is
safe and resilient against threats.
Meanwhile, the Digital Markets Act functions
like the city's anti-monopoly laws,
preventing any single company from dominating the market
and ensuring fair competition.
Now, let's explore each of these industry standards
in more detail.
First, we have
the Payment Card Industry Data security Standard,
or PCI-DSS.
PCI-DSS applies to any business
that handles credit card transactions,
whether it's a small online store or a very large retailer.
The main goal of PCI-DSS is to keep credit card data safe.
And it's built around six key security goals.
These goals include building
and maintaining a secure network,
protecting cardholder data through encryption,
maintaining a vulnerability management program,
enforcing strong access control measures,
regularly monitoring and testing networks,
and establishing an information security policy.
Within the PCI-DSS standard,
credit card merchants are divided into four levels
based on how many credit card transactions
they process each year.
For example, level one merchants are the biggest
processing over six million transactions a year.
And they need to undergo an annual on-site audit
by a qualified security assessor
to make sure they're following all the rules.
They also have to submit an annual report on compliance.
Level two merchants process one million
to six million transactions per year.
Level three merchants process between 20,000
and 1 million transactions per year.
And level four merchants process
fewer than 20,000 e-commerce transactions,
or fewer than 1 million overall transactions per year.
Level two, three, and four merchants generally complete
a Self-assessment Questionnaire, or SAQ,
instead of an on-site audit.
Some of them might also need to run quarterly network scans
by an Approved Scanning Vendor
depending on how they're set up
and how they handle cardholder data.
Second, we have the ISO 27000 Series.
The International Organization for Standardization/
International Electro Technical Commission, or ISO/IEC,
which, again, we will just refer to as ISO in this lesson,
is a group of standards created
as a series of best practices across multiple industries.
Each set of standards is labeled as ISO and a series number.
The entire ISO 27000 Series has about 60 different standards
for different parts of an organization's IT network,
its policies and its controls.
The ISO 27000 series is a set of international standards
designed to help organizations manage
their information security.
These standards offer guidelines
to protect sensitive data from breaches, cyber attacks,
and other cybersecurity threats.
One of the most important standards in this series is
the ISO 27001.
ISO 27001 focuses on establishing, implementing,
maintaining, and continually improving an organization's
Information Security Management System, or ISMS.
This is crucial for industries like healthcare or finance
where protecting data is vital.
Another key standard is the ISO 27002.
ISO 27002 provides best practices
for implementing the security controls
defined in the ISO 27001.
Next, ISO 27005 specifically addresses
information security risk management,
offering guidance on identifying and assessing risks
to better protect sensitive information.
Next, we have ISO 27017.
ISO 27017 focuses on security in cloud services.
Next, ISO 27018 deals
with protecting personal data in the cloud.
Although compliance with these standards
isn't legally enforced,
many organizations adopt them
to follow globally recognized best practices,
demonstrating to clients and regulators
that their data protection strategies are solid.
Third and last, we have the Digital Markets Act, or DMA.
The Digital Markets Act is a regulation
introduced by the European Union
to ensure fair competition in the digital market,
particularly by curbing the dominance
of large tech companies known as gatekeepers.
Gatekeepers are companies that control key digital services
like online search engines, social networking,
and app stores.
They are companies like Google, Apple, and Meta.
The DMA sets strict rules for these companies,
requiring them to allow fair access
to their platforms and data.
For example, DMA ensures that messaging apps
from smaller providers can interoperate
with major platforms like WhatsApp,
so users aren't locked into one service.
Furthermore, the DMA prevents gatekeepers
from favoring their own products over those of competitors
in search results or app stores.
This law is enforced by the European Commission,
and non-compliance can result in hefty fines
of up to 10% of the company's global revenue
or even breakup orders.
The DMA's goal is to promote competition and innovation,
giving smaller companies a fair chance to compete.
So remember, industry standards are guidelines
that organizations follow
to ensure security, compliance, and ethical practices.
These standards are typically set by regulatory bodies
or industry groups,
and help businesses manage risks to protect sensitive data.
For example, the PCI-DSS focuses
on securing credit card transactions,
while the ISO 27000 Series provides comprehensive guidelines
for managing information security across various industries.
Additionally, the Digital Markets Act aims
to promote fair competition in the digital economy
by regulating large tech companies.
Adhering to these standards not only enhances
security and trust,
but also helps organizations avoid non-compliance penalties.