PII Scan and Summary via the RFT Compliance Manager integration

Certain standards, such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), require identification of where PII is stored. Other standards, such as the Payment Card Industry Data Security Standard (PCI DSS) require that some types of information, such cardholder data, be limited to the Cardholder Data Environment and segmented from the rest of the network. Depending on the level of PCI compliance, storage of cardholder data (such as credit card numbers) on drives is strictly prohibited. And the Health Insurance Portability and Accountability Act (HIPAA) require that electronically stored, protected health information (ePHI) be protected in specific manners.

Datto Workplace is, among other things, a secure, version controlled, and logged file storage mechanism. As files (.doc, .docx, .xls, .xlsx, .txt) are uploaded from Windows, Mac, iPhone/Android devices, or via web upload, they are processed, scanned, and logged before they're stored in Datto Workplace.

Compliance Manager GRC includes sensitive data scanning; it looks for PII (for GDPR and CCPA), ePHI (for HIPAA), and cardholder data (for PCI DSS).

The Compliance Manager Integration and the summary that it provides augment the Datto Workplace pre-upload scanner with the Compliance Manager GRC deep file scanner. That scanner looks for PII, ePHI, and cardholder data in files uploaded to Workplace. If any such information is found, the file is tagged, in Workplace, with the specific information type, e.g. Date of Birth, License Number, etc.

When performing a compliance assessment, Workplace Manager users can provide proof of data classification and protection. The integration queries Datto Workplace for all locations of sensitive data as well as which user uploaded the data. Then Compliance Manager GRC presents the findings to the Internal Auditor to determine if there are violations that should be addressed. Any issues will appear in the Plan of Action and Milestones.

With this integration, only newly created, modified, or downloaded files are scanned. The scan occurs when files are changed and/or uploaded to Datto Workplace. This means that during the compliance assessment process, the deep scan is unnecessary and the location and owner of sensitive data is available immediately; you'll have deep scan data available on demand.

1. In Compliance Manager GRC, go to Global Settings > API Keys, generate an API key, and copy it to your clipboard.

NOTE  For detailed instructions concerning how to generate an API key, please refer to this topic in the Compliance Manager help system.

2. In Workplace Manager, go to > Compliance Manager GRC Integration.
   

3. Paste the API key from Compliance Manager GRC into the RFT API Key field.

4. Click the Save button.

5. Toggle the Enable switch to the on position. Once the connection has been established, the page will refresh and display additional integration-related information:
   

6. For each Compliance Manager organization you wish to map to a Workplace team, make a selection from the corresponding dropdown selector.

Any file in which Compliance Manager has found sensitive information will be flagged with a red icon with a fingerprint on it. Hover over the icon to see the type of sensitive data the file contains, as well as a count of how many times that type of data appears in the file.

You can run and download a PII Summary for any team from the Team Detail page. Just go to Workplace Manager > Teams > click a team. Then click the PII report Download button. The report will be generated and downloaded to your default download folder.

Alternatively, you can follow these steps:

1. Access the client's Workplace Online > Reports.

2. Click Special.

3. Select PII Report from the dropdown menu. The report will run automatically.

NOTE  As with all reports, you have the option to export and/or schedule this report.