Federal Laws

PPA (Privacy Protection Act) - protects journalists and others who provide information to the public from the government seizing their work materials


CFAA (Computer Fraud and Abuse Act) - makes unauthorized access of a computer a crime

  • Criteria for lawful evidence collection, chain of custody, and respect of privacy rights

*Originally created to protect federal systems, but has since expanded


ECPA (Electronic Communications Privacy Act) - protects electronic communications, makes intercepting, accessing, or revealing electronic communications without authorization illegal


HIPPA (Health Insurance Portability Act) - protects PHI and ensures the security of electronic PHI


GLBA (Gramm-Leach-Bliley Act) - requires financial institutions to protect personal data and explain to consumers how they are using it

  • NPI (Nonpublic Personal Information): SSN, bank account details, credit history, income


12 CFR 30 Part B (Interagency Guidelines Establishing Information Security Standards) - framework for developing and implementing safeguards to protect consumer information

  • Organization must have a comprehensive written program of administrative, technical, and physical safeguards for customer’s information

  • Systems must be tested regularly


PCI DSS (Payment Card Industry Data Security Standard) - comprehensive security measures for organizations that handle card payments

Objectives:

  • Building and maintaining a secure network and systems

  • Protect cardholder data

  • Maintain a vulnerability management program

  • Implement strong access controls

  • Regularly monitor and test networks

  • Maintain an information security policy

- QSA (Qualifies Security Assessor) - third party assessor to carry out PCI DSS annual compliance audit


SOX (Sarbanes-Oxley Act) - created to protect shareholders and the public from enterprise accounting errors and fraudulent practices


The Cloud Act (Clarifying Lawful Overseas Use of Data Act) - quickens the process of retrieving digital data stored in other countries for the use of U.S. investigations

  • MLAT (Mutual Legal Assistance Treaty) - channel for retrieving information from foreign governments, deemed to be too slow of a process for digital data

  • SCA (Stored Communications Act) - the U.S. government can request data about anyone regardless of citizenship if the company that stores the data is U.S. based


IRS 1075 - standards for federal, state, and local agencies that handle FTI (Federal Tax Information)

  • Requires the implementation of adequate security controls to protect and handle FTI

    SSR (Safeguard Security Report) - organizations must submit an annual report to show     compliance