TRUSTe ISSUES DATA SECURITY GUIDELINES TO HELP COMPANIES BUILD OR UPDATE PRACTICES FOR PROTECTING CONSUMER PRIVACY

TRUSTe answers the call for comprehensive real-world measures providing application-appropriate strategies for strict data security

San Francisco, CA– April 25, 2005 – TRUSTe, the non-profit online privacy leader, today issued its first set of data security guidelines to assist companies in evaluating new or existing policies for protecting consumer and employee personally identifiable information. These guidelines are available as a resource for TRUSTe’s over 1,300 Web seal-holding companies and other members of the public.

TRUSTe, as a business and consumer resource dedicated to respect for personal identity and information, has a long history in providing tools that increase trust between digital businesses and their customers. With the increasing threat of attacks on the stores of consumer information, data privacy has become a central component of trusting business-consumer relationships.

According to TRUSTe, there are ten high-level requirements every company should consider implementing in order to achieve reasonable security protections of personal or sensitive data entrusted to them:

• An enterprise-wide data security policy and employee training program
• Internal control over the collection, use and sharing of confidential or private data
• Access procedures that are based on an individual’s “need to know”
• Internal control over the management of third-party vendor or outsourced relations
• Administrative control and physical security
• Perimeter controls, such as firewalls and VPN
• Encryption over the transfer of sensitive data sent across public networks, especially when using wireless or Bluetooth technologies
• Updates for anti-virus software and security patches
• Identity management and authentication procedures (when feasible)
• Regular tests and monitoring

"Direct and open communication between the privacy and security groups within an organization is critical to data protection. The TRUSTe Security Guidelines provide an excellent framework to facilitate discussions and help ensure that the security aspects of privacy protection are addressed both internally and externally," said Tess Koleczek, chief privacy officer of TRUSTe seal holder, E-LOANâ. “TRUSTe helps companies address both the technology and cultural steps that a company can take to make its data more secure."

TRUSTe conducted extensive research to go along with the organization’s deep experience in digital commerce to establish a set of recommendations that apply to a wide range of corporate functions, network environments and the type of information each business holds.

“Security practices are not ‘one size fits all,’” said Fran Maier, executive director of TRUSTe. “Factors such as a company’s size and complexity, industry category, sensitivity of data collected, number of customers served and use of outside vendors can have a dramatic impact on the steps companies should and can take to protect information. These guideline lead businesses several steps down the road to making the serious decisions needed to provide a well-guarded home for personal information.”

The guidelines are built to evolve and reflect emerging technologies and business issues that impact the safety, security and quality of sensitive or confidential information used by TRUSTe’s licensees. The guidelines also provide several resources to help companies take the final policy and technical steps in building their security systems.

A copy of the full guidelines is available on TRUSTe’s Web site www.truste.org/about/securityguidelines.php. Feedback and comments are encouraged.

About TRUSTe
TRUSTe is an independent, nonprofit organization dedicated to enabling individuals and organizations to establish trusting relationships based on respect for personal identity and information in the evolving networked world.

Founded in 1997, TRUSTe runs an award-winning global privacy certification and seal program. Its seal programs are considered Safe Harbors for the Children's Online Privacy Protection Act (COPPA) and the EU Safe Harbor Framework. Today, TRUSTe maintains the largest privacy seal program with more than 1,400 Web sites certified throughout the world including AOL, Microsoft, IBM, Nationwide and The New York Times. TRUSTe's mission extends standards, certification and oversight into email with Bonded Sender and wireless with the Wireless Advisory Committee. For more information on TRUSTe please visit www.truste.org.

###

 

MAXAMINE