I'm working for a client that keeps records of social security numbers in their databases, numbers pulled from screenings and automatically captured from companies and other financial data. A few million SSNs attached to names, addresses, work history, pay history...etc
As I'm working through their codebase, I keep wondering if there are any regulations that they need to be compliant of. Right now SSNs are encrypted in the DB, but anyone can log into their public-facing web app as an admin with an insecure password (Something as simple as [email protected], pw: admin) and view them in plain text, and existing employees can search for SSNs and view information on the numbers holders.
Is there any sort of compliance (similar to PCI for payment info) that needs to be followed/adhered to for SSNs and personal information?