Overview

U.S. federal law that establishes standards for protecting sensitive patient health information (PHI). Required for healthcare providers, health plans, and healthcare clearinghouses.

Key Requirements

• Privacy Rule - Protects PHI and establishes patient rights
• Security Rule - Physical, technical, and administrative safeguards
• Breach Notification Rule - Reporting of data breaches
• Business Associate Agreements (BAA) required

Overview

Comprehensive data privacy regulation that applies to organizations processing personal data of EU residents, regardless of where the organization is located.

Key Requirements

• Lawful basis for processing personal data
• Data subject rights (access, erasure, portability)
• Privacy by design and default
• Data Protection Impact Assessments (DPIA)
• Appointment of Data Protection Officer (DPO) when required

Overview

U.S. federal law requiring government agencies and contractors to secure information systems and protect government information.

Key Requirements

• NIST SP 800-53 security controls implementation
• Risk assessment and security authorization
• Continuous monitoring and incident response
• Annual security assessments and reporting
• Supply chain risk management

Overview

Auditing standard for service providers storing customer data, focusing on security, availability, processing integrity, confidentiality, and privacy.

Key Requirements

• Trust Services Criteria (TSC) compliance
• Risk assessment and mitigation procedures
• Security policies and procedures documentation
• Vendor management and due diligence
• Incident response and change management

Overview

International standard for establishing, implementing, maintaining, and continually improving an information security management system (ISMS).

Key Requirements

• Information security policies and objectives
• Risk assessment and treatment methodology
• 114 security controls across 14 domains
• Management review and internal audits
• Continual improvement processes

Overview

Security standard for organizations that handle credit card information, established by major credit card brands.

Key Requirements

• Build and maintain secure networks and systems
• Protect cardholder data with encryption
• Maintain vulnerability management program
• Implement strong access control measures
• Regulary monitor and test networks

Overview

U.S. federal law protecting the privacy of student education records. Applies to educational institutions receiving federal funding.

Key Requirements

• Written consent for disclosure of education records
• Student rights to inspect and review records
• Procedure for amending incorrect records
• Limitations on directory information disclosure
• Annual notification to parents and students

Overview

U.S. federal law establishing auditing and financial regulations for public companies to protect investors from fraudulent accounting.

Key Requirements

• Internal control assessment and reporting
• IT general controls and application controls
• Segregation of duties
• Audit trail and change management
• Executive certification of financial statements

Overview

California state law providing data privacy rights to California residents, including rights to know, delete, and opt-out of data sales.

Key Requirements

• Consumer rights to access personal information
• Right to delete personal information
• Right to opt-out of data sales
• Privacy notices and disclosures
• Data breach notification requirements

Overview

Voluntary framework providing guidelines for managing cybersecurity risk, widely adopted across industries and sectors.

Key Requirements

• Identify - Asset management and risk assessment
• Protect - Access control and protective technology
• Detect - Continuous monitoring and detection
• Respond - Incident response and communications
• Recover - Recovery planning and improvements