This might be the wrong place to ask but I thought I would give it a go: I know nothing about data security and I have tried to educate myself over the past couple of weeks and I have come up with a data security policy/protocol for the small business that I am starting. The major hurdle that I have is that I am starting this company without access to a secure network because I am working remotely and traveling for the next few months.
Just a little info about the small business before the policy: its a small business (1-3 employees) that does data analysis, visualization, and data management and processing. The data that we will be working with could be highly sensitive, but it does not need to be HIPAA compliant (at this point).
Here is the draft of the policy...
How you can safely get your data to us
We recommend that you send us your data files via the secure file transfer service we employ. This file transfer service complies with multiple state and federal privacy regulations including HIPAA, PCI-DSS and EU-US Privacy Shield. The system uses 256-bit encryption on SSAE16 and SAS70 certified data centers. All data are deleted from their system after a fixed and short time using a proprietary deletion process. More information can be found at the file transfer service provider’s website (SendThisFile.com).
How we store your data safely
After we receive your data, we temporarily save your files to an encrypted folder on a fully encrypted computer system. This system is then disconnected from the internet and your data are transferred to a highly-secure external hard drive that is protected by 256-bit AES hardware encryption, and a brute force self destruct feature. Next, we permanently delete your files from our servers using overwriting practices to ensure they are truly unrecoverable.
How we keep your data safe during analysis
When it comes time to analyze your data, we disconnect our computer system from the internet before we connect to the encrypted external hard drive. All temporary and permanent data files are directed to the encrypted external hard drive.
How we safely get your data and results back to you
When it comes time to send your results or reformatted data back to you, we save the files from the encrypted external hard drive to an encrypted folder on a fully encrypted computer system. The hard drive is disconnected, our server is reconnected to the internet, and your information is sent via the secure file transfer service. As soon as your data are sent, we permanently delete your data files from our computer system. Once your project is completed, we will retain your data on our encrypted external hard drive for one month, or for a pre-determined period, before we permanently delete your files from our encrypted hard drive.
How we protect our communications
As an added security, all of the emails we send, including email attachments, are protected using end-to-end encryption through Tutanota.