The Complete Azure Compliance Guide: HIPAA, PCI, GDPR, CCPA

Ensuring that your Azure cloud service is compliant with the regulations that cover customer data can be complex. Each set of regulations – HIPAA, PCI, GDPR, and the CCPA – contains different definitions and requirements, all of which have an impact on the way that you work with Azure.

Ensuring compliance with these regulations is critical. HIPAA fines alone cost ten companies $28.7 million in 2018, which broke the previous 2016 record for HIPAA fines by 22%. That’s only 10 HIPAA cases resolved out of 25,912 complaints and 431 data breach investigations. You don’t want to have to worry about a HIPAA complaint against your company, and you don’t want to be one of those that get fined.

In this guide, we’ll show you how to make your Azure system compliant with HIPAA, PCI, the GDPR, and CCPA. Then, we’ll show you how Varonis can help you to do that.

• Where to Start to Ensure Azure Compliance
• Azure HIPAA Compliance
• Azure PCI Compliance
• Azure CCPA Compliance
• Azure GDPR Compliance
• Maintaining Azure Compliance with Varonis

Where to Start to Ensure Azure Compliance

The first step in ensuring Azure compliance is to assess which regulations apply to the data you hold and process. In short:

• HIPAA applies to any organization that holds Protected Health Information (PHI) on any citizen in the USA. The Safe Harbor Rule identifies what kind of data is covered under the act, and the data you must remove to declassify PHI.
• PCI applies to any organization that works with credit card information and is an international standard established back in 2006.
• The GDPR covers the data of all citizens of the European Union (EU), even for companies based outside of the region. If there is even a small chance that you will collect data on EU citizens, you need to make sure you are compliant.
• The CCPA applies to every citizen of California, even where the company collecting data is not based in the state.

Each of these sets of regulations defines “personal data” separately, and contains different requirements on how you are able to store, process, and share this information. We will cover the specific requirements of each, and how they relate to Azure, in the sections below. However, there are a number of high-level principles involved in ensuring Azure compliance with each set of regulations:

• First, you should recognize that the majority of these regulations define your cloud services provider as a “business partner” (or similar terminology). In the context of Azure, this means that you need to ensure that Microsoft is compliant as well as your own organization. We will cover how to do that below.
• Second, be aware that achieving Azure compliance with these regulations doesn’t just involve technical tools and systems. It also requires that managerial processes, access policies, and responses to customer requests also follow strict guidelines. It’s therefore imperative that IT teams work closely with management in working toward compliance in Azure or any other system.
• Third, though these regulations are primarily focused on ensuring data privacy, they implicitly recognize that privacy is inherently related to data security. Because of this, you need to ensure that your systems are also hardened against cyberattacks. This is why working with Varonis alongside Azure is so useful in ensuring Azure compliance.

Beyond these general principles, achieving Azure compliance against each set of regulations requires a different approach. So let’s take each set in turn.

Azure HIPAA Compliance

The Health Insurance Portability and Accountability Act (HIPAA) is a US healthcare regulation. It contains requirements for the use, disclosure, and safeguarding of individually identifiable health information, which that act defines as Protected Health Information (PHI).

The act applies to a huge range of entities. These include doctors’ offices, hospitals, health insurers, and other healthcare companies. Any organization with access to PHI, as well as to business associates, such as cloud service and IT providers, that process PHI on their behalf, need to ensure that they are HIPAA compliant.

Most of the entities covered under the HIPAA do not carry out functions such as claims or data processing on their own; they rely on business associates to do so. Business associates are individuals that work with a covered entity in a non-healthcare capacity and are just as responsible for maintaining HIPAA compliance as covered entities. Business associates are the lawyers, accountants, administrators, and IT personnel that work in the healthcare industry and have access to PHI.

Critically, the definition of “business associate” also applies to your cloud service provider. That means that, in working with Azure, you will need to enter into an agreement with Microsoft to ensure compliance with HIPAA.

Azure and the Microsoft Business Associate Agreement

HIPAA requires that both covered entities and their business associates – defined as any organization that works with PHI – enter into contracts with each other. These contracts ensure that business associates have in place technical and managerial systems to protect PHI. When working with Azure, this means entering into a Business Associate Agreement (BAA) with Microsoft.

The Microsoft BAA clarifies and limits how both you and Microsoft can handle PHI and details the steps that you will both take to adhere to the provisions in the HIPAA. Once a BAA is in place, Microsoft customers — which are covered entities in this case — can use its services to process and store PHI. For Microsoft cloud services like Azure, the HIPAA Business Associate Agreement is available via the Online Services Terms. It is offered by default to all customers who are covered entities or business associates under HIPAA.

It’s important to recognize, however, that entering into a BAA does not, in itself, ensure that you are HIPAA compliant. You can work with PHI in Azure in many ways that are not compliant. In short, you are still responsible for ensuring that you have an adequate compliance program and internal processes in place and that your particular use of Microsoft services aligns with HIPAA.

On the other hand, Microsoft has published extensive guidance on how to use its services in a HIPAA compliant manner. A list of this guidance can be found in Microsoft’s article on the new Azure Security and Compliance Blueprint for HIPAA/HITRUST – Health Data & AI. This portal also points Azure users toward the Azure Blueprints, which are resources to help build and launch cloud-powered applications that comply with HIPAA regulations and standards. These blueprints contain reference architectures, compliance guidance, and deployment scripts that can help organizations to keep Azure compliant.

Which Microsoft Azure services are covered for HIPAA use?

Though Azure is HIPAA compliant, as long as it is used in the correct way, linking your Azure set up to other components can make you non-compliant with the HIPAA. You should, therefore, ensure that you are only using verified Microsoft components. The following services and systems are covered under your BAA with Microsoft:

• Azure and Azure Government
• Cloud App Security
• Microsoft Health Bot Service
• Microsoft Stream
• Microsoft Professional Services: Premier and On Premises for Azure, Dynamics 365, Intune, and for medium business and enterprise customers of Office 365
• Dynamics 365 and Dynamics 365 U.S. Government
• Microsoft Flow cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite
• Intune
• Office 365, Office 365 U.S. Government, and Office 365 U.S. Government Defense
• PowerApps cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite
• Power BI cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite
• Azure DevOps Services

Azure HIPAA Best Practices

Even after entering into a BAA with Microsoft, you will need to ensure that you use and manage your Azure system in a way that keeps it compliant with HIPAA. We’ve previously produced a detailed guide to ensuring this, but the key process controls you need to have in place are as follows:

• Security Management Process: CEs must establish policies and procedures to prevent, detect, contain, and correct security violations. Part of this process is to follow the procedures in the Risk Management Framework to assess overall risk in your current processes or when you implement new policies.
• Assigned Security Responsibility: One designated security official must be responsible for the development and implementation of the HIPAA Security Rule.
• Workforce Security: CEs must identify which employees require access to ePHI and make efforts to provide control over that access. To achieve this, implement a least privilege model and automatically enforce and manage permissions.
• Information Access Management: Restrict access to ePHI via permissions after you have identified the who should have access in the step above.
• Security Awareness and Training: In order to enforce these rules and security policies, organizations need to train their users on what the rules are and how to abide by them.
• Security Incident Procedures: This standard guides the organization how to create a policy to address data breaches: it’s good practice regardless – report breaches and security violations, and set up alerts and security analytics so that you can prevent breaches in the first place.
• Contingency Plan: This is the “what happens next” standard. Create and follow a data backup plan, disaster recovery plan, and have an emergency mode operation plan in place, just in case things go sideways and you get breached. There’s also guidance in this standard for testing and revising these plans, as well as managing critical applications that store, maintain or transmit ePHI.
• Evaluation: Establish a process to review and maintain the policies and procedures to stay up to date and current with the HIPAA Security Rule.
• Business Associate Contracts and Other Arrangements: While it’s ok to use other businesses to implement your overall HIPAA Security strategy, as with any 3rd party contractor, you must get assurances from them that they understand HIPAA and they won’t leak your ePHI.
• This section of the HIPAA Security Rule sets standards for physical security: the “lock your doors” and “batten down the hatches” kind of guidance – along with what to do in case of natural disasters, naturally.
• Facility Access Controls: Limit and audit physical access to the computers that store and process ePHI. Pro tip – put a lock on the server room door.
• Workstation Use: Manage and secure computers (desktop, laptop, and tablets) that are used to access ePHI. Every computer with access to a CEs ePHI must adhere to this policy, including systems that are offsite (and offline).
• Workstation Security: Implement physical safeguards for all computers that access ePHI: restrict access to computers that access ePHI, install remote wipe safeguards on laptops that grow legs.
• Device and Media Controls: Once computers are covered, you still need safeguards on all the rest: devices and media like USB drives, tape backups, or removable storage. Establish a policy to inventory, allow the use of, and reuse or dispose of these devices as needed.
• Technical safeguards are the technology and procedures that covered entities use to protect ePHI: The HIPAA Security Rule does not define what technology to use – but demands that CEs adhere to the standard and adequately protect ePHI from data breaches.
• Access Control: Authenticate users as necessary to access ePHI, establish and maintain a least privilege model, and have appropriate procedures in place to audit access control lists (ACL) on a regular schedule.
• Audit Controls: Audit your ePHI to record and analyze activity in case of a data breach. CE’s need to provide a complete audit trail of the data breach and what PHI be able to show the OCR exactly how a data breach occurred with a complete audit trail and reporting.
• Integrity: To be HIPAA compliant, CEs need to be able to prove that the ePHI they manage is protected from threats both inside and out, intentional or not. Whether the new intern deletes a record accidentally, or a nefarious hacker deletes it intentionally, you should be able to recover and restore that record.
• Person or Entity Authentication: CEs must provide assurances that the person accessing ePHI is, in fact, who they say they are. These assurances can be a password, two-factor authentication, or retinal scan – whatever works as long as you have something implemented.
• Transmission Security: When sending data to other business partners, you need to be able to prove that only authorized individuals accessed the ePHI. You can use an encrypted email with a private key, HTTPS file transfer, or a VPN – as long as only the people that are authorized to use the ePHI, HIPAA doesn’t care how you set it up.

Beyond these basic procedures, you will also need to have in place a system for responding to customer requests for data, and for responding to breaches. You can find more information on how to develop these processes in our article on HIPAA compliance.

Azure PCI Compliance

PCI (Payment Card Industry) data compliance is another regulatory framework that requires you to manage and use your Azure system in specific ways. PCI is a set of standards and guidelines that set out how businesses can keep credit card information safe and secure.

The Payment Card Industry Data Security Standards (PCI DSS) guidelines were published back in 2006 and were developed by major credit card companies – Visa, Mastercard, and American Express. The primary focus of these guidelines was to prevent credit card fraud by ensuring that data relating to credit cards is not stolen.

Organizations of all sizes must follow PCI DSS standards if they accept payment cards from the five major credit card brands — Visa, MasterCard, American Express, Discover, and the Japan Credit Bureau (JCB). Compliance with PCI DSS is required for any organization that stores, processes, or transmits payment and cardholder data.

Unlike HIPAA compliance, achieving PCI compliance in Azure does not require that you enter into an agreement with Microsoft. It does, however, require that you take steps to secure your Azure system against hackers. Here is how to do that.

Which Microsoft Azure services are covered for PCI use?

In principle, Azure gives you everything you need to be PCI DSS compliant, as do other business services offered by Microsoft. However, it’s important to understand that PCI DSS compliance status for Azure, OneDrive for Business, and SharePoint Online does not automatically translate to PCI DSS certification for the services that you build or host on these platforms.

In general, these are the services that can be made PCI  DSS compliant:

• Azure and Azure Government
• Cloud App Security
• Flow cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite
• Graph
• Intune
• PowerApps cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite
• Power BI cloud service either as a standalone service or as included in an Office 365 branded plan or suite
• OneDrive for Business and SharePoint Online (United States only)

Azure PCI Best Practices

A good place to start when working toward PCI compliance in Azure is to review the resources that the PCI Security Standards Council has made available. The council publishes the PCI DSS Quick Reference Guide for merchants and others involved in payment card processing, and this is a good place to learn about specific compliance requirements. The guide explains how the PCI DSS can help protect a payment card transaction environment, and how to apply it.

When working with Azure, you can also make use of the templates and guidance that Microsoft has made available. The Azure Security and Compliance PCI DSS Blueprint offers a great foundation for this. The blueprint contains reference architectures, deployment guidance, control implementation mappings, automated scripts, and more. It provides a roadmap you need to follow to become PCI compliant by presenting a  12-step plan to protect customer data.

Since the PCI regulations contain 12 major requirements, the set of practices you need to ensure that you are following in Azure can also be broken down in this way:

The way in which you meet these requirements will depend on your business, and on your Azure architecture. However, you should ensure that you are meeting each of the requirements above in order to ensure that you are PCI compliant.

More information on working toward PCI compliance can be found in our detailed guide, which will walk you through all the steps you need to take.

Azure CCPA Compliance

The California Consumer Privacy Act (CCPA) is the first act of its kind in the USA: it aims to protect the privacy of the citizens of California by providing them with rights as to how companies can store, process, and sell personal information. In many ways, the CCPA is similar to the GDPR (see below), but there are some specific requirements that you will need to be aware of in building an Azure system that is CCPA compliant.

The first step is to check if the CCPA applies to your business. The regulation only applies to companies doing business in California which satisfy one or more of the following:

1. Have a gross annual revenue of more than $25 million, or
2. Derive more than 50% of their annual income from the sale of California consumer personal information, or
3. Buy, sell or share the personal information of more than 50,000 California consumers annually.

If these apply to your business, you will need to be compliant by July 1, 2020. Though the CCPA came into force on January 1, 2020, the California Attorney General (AG) will start to enforce the law in July.

Non-compliance with the CCPA will likely be punished with fines levied by the Attorney General. The CCPA also provides a “private right of action” which is limited to data breaches. Under the private right of action, damages can be charged between $100 and $750 per incident per consumer. The California AG also can enforce the CCPA in its entirety with the ability to levy a civil penalty of not more than $2,500 per violation or $7,500 per intentional violation.

Which Microsoft Azure services are covered for CCPA use?

The role of Microsoft in relation to the CCPA is spelled out in the regulations themselves: in the context of the act, Microsoft acts as a “service provider”. The vast majority of online services offered by Microsoft are already CCPA compliant via the Online Services Terms (OST) and the Microsoft Professional Services Data Protection Addendum (MSDPA) that govern your relationship with Microsoft.

Because of this, a wide range of cloud services are compatible with the CCPA:

• Azure (PDF)
• Azure Dev Ops
• Dynamics 365 (PDF)
• Intune
• Office 365 (PDF)
• Support and Professional Services
• Visual Studio

However, you should be aware that you also need to use Azure in particular ways in order to ensure your system is CCPA compliant. Unlike HIPAA and PCI compliance, the CCPA does not specify particular technical measures that need to be in place to protect data, except in very general terms. Instead, achieving CCPA compliance is about putting in place two systems:

• Processes to identify personal data within Azure, in order to respond to customer requests,
• A managerial system for handling these requests.

A good place to start with complying with the CCPA is to use the tools that Microsoft has made available for assessing compliance against the GDPR. Because these two sets of regulations are quite similar, you can use the GDPR assessment in Compliance Score as part of your CCPA privacy program. Beyond this, you should also:

• Establish a process to efficiently respond to Data Subject Access Requests (DSARs) using the Data Subject Requests tool.
• Set up systems and policies to discover, classify & label, and protect sensitive data with Microsoft Information Protection.
• Use email encryption capabilities to further control sensitive information.

Azure CCPA Best Practices

Once the basic tools for CCPA compliance are in place, you need to apply a number of best practices to the way that you work with Azure in order to ensure that you stay compliant.

The CCPA essentially works through a “rights” model: instead of closely regulating the way that you store and process data, it gives your data subjects the right to know how, when, and why you are collecting information, and allows them to make Data Subject Access Requests (DSARs) to access and delete their data. Allowing them to do so for your Azure system means that you need to have in place a labeling system for all the data you hold, so you can identify personal information you hold.

These rights can be summarized as follows. As an organization working with personal data, you need to have the ability to:

• Provide disclosures to consumers, prior to collection, regarding the categories and purposes of collection.
• Provide more detailed disclosures in a privacy policy regarding the sources, business purposes, and categories of personal information that is collected, including how those categories are sold or transferred to other entities.
• Enable DSR rights of access, deletion, and portability for the specific pieces of personal information that has been collected by you.
• Enable a control that will permit consumers to opt-out of the sale of the consumer’s data. However, transfers to exempt entities, such as service providers, will be permitted.
• For minors, under 16, enable an opt-in process so that no sale of the minor’s personal information can occur without actively opting-in to the sale.
• Ensure that consumers are not discriminated against for exercising any of their rights under CCPA.

More information on dealing with DSARs and other aspects of the CCPA with Azure can be found in Microsoft’s guidance on working with Azure, and more general advice can be found in their white paper on Managing Compliance in the Cloud.

Azure GDPR Compliance

The European Union’s General Data Protection Regulation (GDPR) took effect back in May 2018, and to date is the most complex and rigorous piece of privacy legislation in force anywhere in the world.

The GDPR imposed new rules on companies, government agencies, non-profits, and other organizations that offer goods and services to people in the European Union (EU), or that collect and analyze data tied to EU residents. All organizations need to ensure that they are GDPR compliant if they are collecting data on EU citizens, no matter where your company is based.

Achieving GDPR compliance in Azure can be challenging, but Microsoft has provided organizations with a huge number of resources for doing so. The full text of GDPR is extremely long, running to 99 individual articles, and so the only practical way for most organizations to achieve compliance is to rely on templates and reference architectures for Azure that have been assessed to be GDPR compliant.

On the other hand, there are a number of key principles that all organizations should keep in mind when working with Azure. These are set out in Article 5 of the legislation, which gives details on how people’s data can be handled. These principles don’t act as hard rules, but instead as an overarching framework that is designed to lay out the broad purposes of GDPR.

Details of the way that these principles can be applied in Azure can be found in our white paper on working toward GDPR compliance, where we also explain how the key features of Varonis map to the important articles contained in the GDPR.

Which Microsoft Azure services are covered for GDPR use?

The GDPR contains so many provisions that it is impractical to give a list of all of the Azure components that are covered for GDPR use. In fact, the scope of the legislation means that it affects how you should use every component of your cloud storage system.

Given this, Microsoft’s guidance on achieving GDPR compliance does not contain a prescriptive list of which Azure components can be used. Instead, it takes a more fundamental approach. The Azure Security and Compliance GDPR Blueprint is designed to help organizations to build and launch cloud-powered applications that meet the requirements of the GDPR. This Blueprint includes guidance and common reference architectures designed to simplify the adoption of Azure to support your GDPR compliance initiatives.

This Blueprint contains four key reference architectures for working with Azure toward GDPR compliance. Each of these solutions can act as the basis for building an Azure-powered, GDPR-compliant system:

• Data Analytics

An SQL-based analytics platform that enables organizations to securely ingest, store, analyze, and interact with personal data while meeting GDPR compliance requirements. This solution includes Machine Learning services, Azure Functions, and Azure Event Grid.

• Data Warehouse

An Azure SQL Data Warehouse that enables organizations to securely ingest, stage, store, and interact with personal data while meeting GDPR compliance requirements. This solution includes SQL Server Reporting Services (SSRS) for quick creation of reports from the Azure SQL Data Warehouse.

• Infrastructure as a Service

An IaaS web application with a database backend, including a web tier, data tier, Active Directory infrastructure, application gateway, and load balancer. This solution includes Operations Management Suite (OMS), Azure Monitor, and Azure Security Center for system health monitoring.

• Platform as a Service

A PaaS web application with an Azure SQL Database backend, including an App Service environment that balances traffic for the web application across VMs managed by Azure. This solution includes Application Insights which provides real-time application performance management and analytics through Operations Management Suite (OMS).

For organizations looking to use Azure to work with data covered by the GDPR, these reference architectures act as a template for building such a system.

Azure GDPR Best Practices

Keeping your Azure system GDPR compliant also means applying a number of key practices, each based on a set of resources and tools provided alongside Azure.

• The Azure Data Subject Requests for the GDPR portal provides step-by-step guidance on how to comply with the GDPR requirements to find and act on personal data that resides in Azure. The ability to execute data subject requests is available through the Azure portal on both public and sovereign clouds, as well as through pre-existing APIs and UIs.
• Azure Policy is deeply integrated into Azure Resource Manager and helps your organization enforce policy across resources. Azure Policy can be used to define policies at an organizational level to manage resources and prevent developers from accidentally allocating resources in violation of those policies. You can use Azure Policy in a wide range of compliance scenarios, such as ensuring that your data is encrypted or remains in a specific region to comply with the GDPR.
• Compliance Manager is a free workflow-based risk assessment tool that is designed to help organizations manage regulatory compliance within the shared responsibility model of the Azure cloud. It delivers a dashboard view of standards, regulations, and assessments that contain Microsoft control implementation details and test results as well as customer-managed controls. This enables you to track, assign, and verify your organization’s regulatory compliance activities.
• Azure Information Protection, which offers file-share scanning for on-premises servers to discover sensitive data, can enable you to label, classify, and protect it thereby improving organizational data governance.
• Azure Security Center provides unified security management and advanced threat protection. Integration with Azure Policy enables you to apply security policies across hybrid cloud workloads to enable encryption, limit organizational exposure to threats, and respond to attacks.
• Azure Security and Compliance GDPR Blueprint is designed to help you build and launch cloud applications that meet GDPR requirements. You can leverage Microsoft’s common reference architectures, deployment guidance, GDPR article implementation mappings, customer responsibility matrices, and threat models to simplify adoption of Azure in support of your GDPR compliance initiatives.

Leveraging these tools is critical in designing your Azure architecture to be GDPR compliant, and in keeping it that way. The scope and complexity of the GDPR is such that many organizations will have to return to the basic way in which their Azure system is built, and potentially re-design this in order to ensure compliance.

Maintaining Azure Compliance with Varonis

Varonis helps organizations stay compliant with HIPAA, PCI, GDPR, and CCPA by providing the core functionality organizations need to find and protect their sensitive information throughout their unstructured data stores, like Windows and Office 365.

Organizations need to know where their protected data lives, who has access to that data, and what is happening to that data so that they can ensure sensitive data doesn’t fall into the hands of people it shouldn’t. With this level of visibility and control, organizations can maintain compliance with regulations more confidently.

Classify Sensitive Data

The first step in complying with regulations like HIPAA and CCPA is knowing what data you need to protect and where it exists throughout your environment.

Varonis includes pre-built classification patterns for HIPAA, PCI, GDPR, and CCPA. The classification rules include intelligent validation and proximity matching to improve the quality of classification results and reduce false positives.

Manage Access to Data

Once sensitive data has been identified, the next step is protecting it. Organizations need to both understand and manage who has access to data on their network, so they can ensure that only authorized users can access protected data.

Varonis maps permissions for each folder across multiple data stores and tracks them in a unified, bi-directional view, meaning admins can not only see who has access to a certain folder but also which folders a user has access to. Varonis recommends changes to permissions to keep access in line with a least-privilege model based on user activity. For example, Varonis might recommend that a user who never accesses a folder be removed from those who can access it. Admins can simulate changes to ensure they don’t remove access that might still be needed. They can even automate these access changes and remove global access at scale without affecting business continuity.

Monitor Sensitive Data for Threats

And finally, to ensure protected data remains safe, organizations need to monitor for potential threats. Data breach notification requirements vary from regulation to regulation, but they all require an organization to know when sensitive data is accessed by an unauthorized user.

Varonis provides a full audit trail of data activity to help security teams understand how sensitive data is accessed. Accurate reporting in case of a data breach is key.

Varonis uses behavioral baselines and threat modeling to detect active cybersecurity threats before they become a data security incident. User activity is logged and enriched with Active Directory and perimeter telemetry to discover abnormalities. For example, if a user begins to access protected data they have never touched before, Varonis triggers an alert.

A Final Word

Achieving and maintaining Azure compliance with regulatory frameworks can be complex. The HIPAA, PCI, GDPR, and the CCPA all contain different definitions, and varying provisions on how you can collect, process, and share personal data.

It is therefore critical that you make use of the resources available to you to both ensure data privacy and reduce your risk of cybercrime. You should make sure you understand in detail how to achieve HIPAA compliance, PCI compliance, and any other form of Azure compliance that is relevant to your organization. This involves maintaining Azure architectures that are compliant with legislation and applying a number of working processes to them.

Using Varonis alongside your other compliance processes can make achieving compliance much easier, because the data protection and management systems that Varonis offers map directly to the key principles of HIPAA, PCI, CCPA, and the GDPR.