- [Instructor] Being compliant with applicable laws
and regulations is one of the four major goals
of an information security program.
Because of the growing importance of information security,
there are many laws and regulations,
and we can expect more to emerge in the coming years.
You'll find applicable laws and regulations
at many levels of governance,
everything from multinational requirements,
all the way down to national, state, and local levels.
You'll even find some industries are self-regulating.
Let's review a few of the more common laws and regulations
you're likely to see.
We'll start with some broadly
applicable laws and regulations.
Enacted by the United States in 2002,
the Sarbanes-Oxley Act
applies to publicly traded US companies.
It's designed to protect investors and the public
by increasing the accuracy and reliability
of corporate disclosures,
particularly, financial ones.
That means information security programs
need to make sure their organization's financial data
is safeguarded, whether they are publicly traded or not.
The Payment Card Industry Data Security Standard
is a set of requirements
for securing payment card customer data.
It was developed by the founders
of the PCI Security Standards Council,
which includes American Express, MasterCard, and Visa.
PCI DSS applies to anyone handling credit card data,
including retailers, banks, and the credit card companies.
Data breach notification laws
have been enacted in most US states since 2002.
California was the first in the US.
The European Union passed such a law in 2009.
They all require organizations
to notify affected customers about data breaches.
These laws also require organizations to take other steps
to protect consumers involved in the breach.
Now, let's turn to some industry-specific
regulations and guidelines.
Enacted in 2002,
the Federal Information Security Management Act
requires US federal agencies to implement a program
to provide security for their information
and information systems.
The North American Electric Reliability Corporation
has published standards
for the bulk power system of North America.
It protects the industry's critical infrastructure
from physical and cyber threats.
The Health Insurance Portability and Accountability Act
requires the adoption of standards nationwide
to protect electronic healthcare transactions.
The law also requires guarding the security and privacy
of personal health information.
It applies to healthcare providers, health plans,
and health clearinghouses,
who are all known as covered entities.
HIPAA also applies to business associates,
which are non-healthcare companies
that serve covered entities.
An outside company that prints and mails
explanation of benefit statements
is an example of a business associate.
The Health Information Technology
for Economic and Clinical Health Act
significantly modified HIPAA in 2009.
It added new requirements concerning privacy and security
for patient health information.
And it applies to both covered entities
and business associates.
On the data privacy front, one of the most important laws
is the European General Data Protection Regulation.
The European Union has been regulating
the general processing of personal data since at least 1995.
If you don't already know,
it's important to realize that people in the EU
have higher expectations when it comes to personal privacy
as compared to people living in the United States.
With the pressure from GDPR on American commerce,
and the recent election influencing scandals,
California's Consumer Privacy Act
became law on January 1st, 2020.
CCPA vastly increases the definition
of personal information,
and it makes it much easier
to heavily penalize organizations
that fail to protect PI.
And now, at least a dozen other states
are working to pass similar laws.
We may even see a single national law in the next few years.
Figuring out which laws and regulations
apply to your organization takes time to research.
And usually requires legal counsel
in order to be highly confident in your conclusions,
which you'll want to be
before you spend significant time and money
trying to comply with them.