I cannot find a defined "Gold Standard" within the US, but there is ISO27001:2013 here in the UK and the European Union. More can be found from this IT Governance website.
There is also suggestion that you should also follow ISO27018:2014 if you are storing data in public cloud systems.
In absence of any defined "Gold Standard", you can choose to follow these standards, and if you are not following the "Gold Standard", you need to be able to justify your data protection procedures to any governing body who may be auditing you for compliance with their rules and regulations or when investigating any data breach.
Some say that just following a "Gold Standard" is not enough.
The one thing you should do is regularly review your procedures to ensure you are doing everything reasonably practicable to ensure personally identifiable data is kept secure from unauthorised access. Do you have a copy of your data protection policy and procedures which you personally follow and regularly review and sign off as reviewed? If not, I would put one together and sign it off regularly at review as that would demonstrate your commitment to protecting client's personal information.
One major key point you need to remember with data protection is that you must protect the data from unauthorised access at all points of access.
The following is in response to your individual questions.
Is it enough to put the electronic storage device (laptop, hard drive, flash drive, whatever) inside a locked room in a locked house?
When reviewing your data protection policy and procedures, you should ask this question to yourself along with who has access to the keys to the locked room?
If anyone not authorised to access the personal data has access to the keys then the answer in my view is that it is not enough. Otherwise, how are you going to prevent unauthorised access by others who have access to the keys to the locked room?
Is it enough to password protect the storage device, and put it in a locked building
With regard to locking the storage device in a building, that is covered in the previous question. Password protection can add further protection, but is it enough? This goes with your 3rd question
Is it enough to password protect the storage device, and password protect the folder/file
This is not straight forward to answer and will depend on many different factors.
If the password is strong, the storage device remains in the one room, and is always locked away when unattended then passwords will provide extra protection but will it be enough protection from theives who might break in and steal the storage device?
Windows 10 provides device encryption, but not Windows 10 Home it needs to be Windows 10 Pro or Enterprise. Encryption will prevent data from being read if the harddrive was removed and transferred to another computer.
There is 3rd party software available for device encryption and each one is different to the other on strength of encryption, security and cost.
If you are talking about files such as Microsoft Word documents or Excel files, you can password protect the file from being read, and in this case, Microsoft Office encrypts the file. If stored on an encrypted device, this double encrypts the file from access.
These are things to think about.
And what about files in the cloud?
In response I would ask Do you really need to store the data in the cloud?
If so, then I would be very picky as to what cloud service you choose to use.
- Who can access your data in the cloud?
- Can the cloud service provider(s) access the data?
I only know of one cloud service provider who has no access to your data. With them, the files are encrypted their end and if you forget your password, you have lost access to your data for good. There may be others but I don't know them if there are.
- If the cloud service provider can access your data, what is their policy with regard to Privacy and Data Protection? Is it in line with yours? - Keep an up-to-date copy with your policy and procedures.
- Is the data encrypted in the cloud?
- Is the data transfer encrypted end-to-end when transferred between the cloud server and your storage device, and if so, how strong is that encryption?
These are just some questions you will need to find the answers to, and there may be others you feel need addressing.
Protection of digital data is not straight forward but if you think things through thoroughly and seek professional advice where needed you can devise a robust protection procedure which can be justified to any governing body.
Links to sources provided in this answer