Policy-driven automation to assist with regulatory compliance

Cranfield University is currently using Sonar to discover and report on Payment Card Industry Data Security Standard (PCI-DSS) data and United Kingdom PII across our virtual server estate. “When we first ran Sonar, we detected thousands of hits that included credit card information, national insurance numbers, or user’s tax references that needed mitigation efforts. We were able to quickly address which information was acceptable, what needed actioning and importantly, where individuals stored sensitive information in inappropriate locations.”

With Sonar in place, Verrier and team can now build repeatable processes to ensure the organization is meeting data governance policies. “We can now mark files that require further investigation and take action, such as removing or move data to the right locations. Similarly, we can add them to our exclusion/allow list so they are no longer flagged in future scans. If we identify where improvements can be made, we can approach the owners of the data sets directly in order to manage sensitive data more effectively,” said Verrier.

For Verrier and team, it is critical to meet compliance requirements in order to avoid potential costly GDPR and Information Commissioner’s Office (ICO) fines. Verrier said, “A major business consequence for non-compliance is brand damage and loss of reputation. Our university has numerous high-profile partnerships with global businesses. If sensitive data was exposed, it could put those relationships at risk. Our team must ensure we meet not only our own, but also our partners’ IT and security requirements with confidence.”