My startup is finally faced with the potential responsibility of handling PII, and we're concerned with doing it properly from a risk perspective but also so that we're doing this correctly.
What would be the best approach if we wanted to do it ourselves?
We don't currently have a security engineer, but we're operating relatively safely and in Google's Cloud Platform. We've made good design decisions in how our app security works, but we may have to start handling PII so we want to make sure that if it ever is at-rest we are covered.
I know Google offers certifications and white papers on their security, but I'm guessing we'd also need to get our own, from a third party auditor.
Any description of how to go about this would be immensely useful, from best practices and considerations to mandatory implementations.