Virima V6.0 will soon be available with an all-new look, enhanced discovery, mapping and vulnerability features and more. Stay tuned!

GDPR & ITSM: Is your IT service management system ready?

GDPR EuroMap

The General Data Protection Regulation (GDPR) went into effect in May 2018. This comprehensive new set of rules is intended to protect the private information of European Union (EU) citizens, wherever they are in the world. This has significant implications for any company that does business with EU citizens, wherever that company is located.


GDPR: What It Is and Why It Matters

GDPR officially took effect on May 25. It is designed and intended to protect the personally identifiable information (PII) of European Union (EU) citizens, wherever those citizens happen to be in the world. 

This means that no matter where your business is located, if you do business with EU citizens, your business must comply with GDPR, and be able to demonstrate compliance in response to regulator demands.

Under GDPR, every organization that touches EU PII is either a controller or a processor. Basically, controllers are considered “owners” of the data, while processors process the data on behalf of controllers, but do not own it. And controllers can be held liable for lapses in PII security caused by processors working with them. This is why controllers and processors typically work under Data Processing Agreements that spell out the specifics of the processes and security measures in place.

Whether your business is a controller, a processor, or both, penalties for non-compliance with GDPR are huge. The lowest-tier penalty is two percent of your business’ global annual revenues, or 10 million Euros, whichever is higher. 

There is a second, higher tier as well. At that level, Each GDPR violation can cost as much as four percent of your business’ global annual revenues worldwide, or 20 million Euros, whichever is higher. Regulators have reportedly indicated that bans on violating businesses are possible as well.


The Penalties in 2019

Every EU member state has a Data Processing Authority (DPA) responsible for enforcing GDPR. Businesses are expected to self-report breaches that could threaten EU PII to their DPA within 72 hours of discovering the breach.

The DPA for the United Kingdom (UK) is the Information Commissioner’s Office (ICO). In April 2018, the month before GDPR took effect, the ICO received reports of 367 breaches. In June, the first full month after GDPR took effect, the ICO received 1,792 such reports.

Not all breaches are GDPR violations, but some are very likely to be. And with violations will come fines, bans, and reputational damage. Great reasons to minimize breaches and maximize PII control, security, and transparency at your business.


Preparing for GDPR

It almost doesn’t matter whether your business is a GDPR controller, processor, or both. GDPR still represents a clarion call to all IT decision makers to devote serious attention to knowing where, when, and why PII traverses any part of their business’ IT estate.

The knowledge you need starts with whatever your business knows about the core of its IT infrastructure. This includes your endpoint devices, your servers, your cloud-based services, and your most critical applications. You also need to be able to map and track the interconnections that link all of those elements to one another and to your users.

To achieve and maintain the knowledge you need, you need four enablers – effective IT Asset Management (ITAM), IT Service Management (ITSM), a Configuration Management Database (CMDB), and interoperability among all three. Your ITAM and ITSM solutions can map and track what’s in your IT infrastructure. The CMDB is your key to mapping and tracking the relationships among your infrastructure elements and users.

(See, “Why You Can’t – and Shouldn’t – Spell “GDPR” without “ITAM””)

All of these solutions must also be closely harmonized with cyber security initiatives at your business. (A recent webinar co-hosted by Virima and follow-up address the bringing together of IT and cyber security operations and management in detail.)

GDPR is just the latest high-profile effort to protect PII and punish those who fail to do so. More such regulations are coming – during and beyond 2019. 

Protection for your business begins with the technologies and processes that govern its IT and cyber security operations. If your business hasn’t yet begun pursuing ITAM, ITSM, or CMDB deployment, it may now have sufficient inducement to do so.


Get Your IT Management “GDPR-ready” With Virima

Virima’s solutions for IT Asset Management (ITAM) and IT Service Management (ITSM) can help you protect the PII of your customers and users, and your company. Virima solutions can automatically discover and map your critical IT resources and the interconnections that link them to one another, your applications and services, and your users. 

In addition, they’re built to be easy to use and configure, and to produce useful, actionable reports about your IT environment, for IT managers and business decision makers. 

Virima features can automatically discover and map your critical IT resources and the interconnections that link them to one another, your applications and services, and your users.

Virima is here to help. To get started, contact us today to schedule a demo and explore the possibilities!

Subscribe to Our Newsletter

More to Explore

Table of contentsUnderstanding business service mappingA modern approach to business service dependency mappingDiscovery planning processUse casesVirima simplifies service mapping and IT discovery Business service mapping is the area of configuration management that perplexes so many IT professionals. Yet, it provides…

Understanding the Configuration Management Database (CMDB) and its core functions is a critical aspect of service management. The CMDB forms the hub of numerous service management practices and provides a means of correlation needed to deliver business services successfully.   The…

Table of contentsYour CMDB is stale because it's incomplete.Your CMDB is stale because you haven't checked in with your people.Your CMDB is stale because you're only updating it a few times a year.How to update your dead CMDB?You can update…

When you're an IT professional, there's nothing more frustrating than having to deal with change management. Enter CMDB. A CMDB helps you with change management effectively and quickly. Configuration Management Database (CMDB) is one of the most important concepts for any…

Table of contents3 Strategies to Reduce IT Security Risks with IT Asset ManagementStrategy 1: Identify and Prioritize Critical AssetsStrategy 2: Conduct Regular Audits and AssessmentsStrategy 3: Train Your Team on Security Best Practices How can ITAM help with risk management?ITAM can…

Table of contentsWhat is the purpose of a CMDB?Why is a CMDB important?What can be stored in a CMDB?How to create a CMDBA well-maintained and integrated CMDB is critical to effective IT service management.CMDB is critical—Create one that you can…

Table of contentsEstablish ownership of the CMDBIdentify roles and responsibilitiesDetermine governanceDefine configuration items and updatesDefine a configuration item as a unique entityDefine a configuration item as manageableDefine data quality standardsDetermine integration and interfaces with other systemsBuilding a solid foundation for…

Table of contentsCloud asset management doesn't have to be hard—Virima makes it easy!ITAM and multi-cloudWhy you need an ITAM solutionHow ITAM software reduces IT costsAutomates processes Reduces time spent on maintenanceReduces time spent on complianceHow the Virima ITAM platform differs from…

Table of contentsWhat is a CMDB and why do you need one?The major features of an ideal CMDB include:Auto discoveryCategorizationChange managementService mappingConfiguration management data modelAsset managementEvent correlation and root cause analysisCMDB - A holistic way to manage your services and…

Table of contentsWhat is CMDB?Why you should invest in a CMDB implementationHow well do you know your CMDB?Data security in CMDBIT staff and the CMDBCybersecurity issues in the CMDBCyberattacks on Configuration Management DatabaseBottom line - how to improve CMDB securityIn…