Compliance - Detailed Look at Specific Laws

Study Notes

FISMA (Federal Information Security Management Act)

Requires federal agencies to develop, document, and implement an information security and protection program
Key focus areas include risk assessments, security controls and policies, and continuous monitoring
Example: Implementing role-based access control to ensure sensitive information is only accessible to authorized personnel

HIPAA (Health Insurance Portability and Accountability Act)

Protects sensitive patient health information from being disclosed without patient consent or knowledge
Key focus areas include Privacy Rule and Security Rule
Privacy Rule: Protects the privacy of individually identifiable health information
Security Rule: Sets standards for the security of electronic protected health information
Example: Encrypting patient data transmitted electronically to comply with HIPAA's Security Rule

GLBA (Gramm-Leach-Bliley Act)

Requires financial institutions to explain their information-sharing practices to customers and to safeguard sensitive data
Key focus areas include Financial Privacy Rule and Safeguards Rule
Financial Privacy Rule: Governs the collection and disclosure of customers' personal financial information
Safeguards Rule: Requires institutions to implement security programs to protect such information
Example: Issuing a clear and concise privacy notice to customers, explaining how their personal information is used and protected

SOX (Sarbanes-Oxley Act)

Protects shareholders and the general public from accounting errors and fraudulent practices in enterprises, and improves accuracy of corporate disclosures
Key focus areas include maintenance of audit records and certification of internal controls
Example: Publicly traded companies must regularly review and certify the effectiveness of their internal controls over financial reporting

FERPA (Family Educational Rights and Privacy Act)

Protects the privacy of student education records
Key focus areas include student's right to access their education records, right to request record amendment, and control over disclosure of personal information
Example: Allowing students to view their educational records online while protecting those records from unauthorized access

PCI DSS (Payment Card Industry Data Security Standard)

Security standards designed to ensure companies that accept, process, store, or transmit credit card information maintain a secure environment
Key focus areas include protecting stored cardholder data, encrypting transmission of cardholder data, and regularly monitoring and testing networks
Example: Implementing end-to-end encryption technology to protect cardholder data during transactions

Description

This quiz covers the Federal Information Security Management Act (FISMA) and the Health Insurance Portability and Accountability Act (HIPAA), focusing on risk assessments, security controls, and continuous monitoring to protect sensitive information.