-: Laws and regulations.
So we've talked about our policies
and we've talked about our audits and our assessments,
and sometimes you have laws that require
that you have things in your policies and procedures.
So we wanna talk about those laws
and which organizations they apply to
because in the United States,
there's so many different laws out there
that are gonna have to be adhered to
depending on the industry.
If you're in healthcare, there's one set of rules,
if you're in finance, there's another,
if you're in education, there's yet another,
and CSA+ focuses on US because
CompTIA is a US focused organization.
Now if you go into the European Union,
they have a broad range of data protection laws as well
but they tend to consolidate them all
and it's a lot easier to keep track of.
Now as we go through this lecture,
we're gonna focus on the CSA stuff
so it's really gonna be focused on America
and on the United States laws and regulations.
The first one I wanna talk about is HIPPA
and this is gonna be security and
privacy regulations for healthcare.
HIPPA stands for the Health Insurance
portability and accountability act.
This is a law that was passed by congress
in the United States that affects all healthcare providers,
insurers and anybody who stores health information.
So, if you're a company that decides
you're gonna make some kind of app
for the doctors on the app store or on Google Play,
HIPPA's gonna apply to you too
because you're processing and storing health information.
So, when we start talking about the next one,
we're talking about GLBA and GLBA
is the Gramm-Leach-Bliley Act.
This is named for the three congressmen
who came together and create this act.
This act came out in the late 90s,
early 2000s and requires financial institutions
to have formal security programs in place
to protect the data, this also requires
that they have a designated responsible individual.
Now again, legislated is a pretty broad term
when they talk about responsible individual.
But normally, what's gonna happen is,
each company's gonna designate a CIO or a CSO,
a chief information officer or a chief security officer
and they'll act as the responsible individual.
The next one I'm going to talk about is Sarbanes-Oxley
which is named after two congressmen.
This one is called SOX or Sarbanes-Oxley,
written as SOX and this is requiring
all publicly trading companies
to maintain good security around their IT systems
that store and process their financial records.
Now, why was the law put into effect?
It really wasn't to protect the company's information,
but to protect the ability of somebody from the outside
to come in and audit that information.
Because there's some shady dealings going on
in the early 2000s, with some of the companies,
where they would "accidentally" lose their information,
maybe accidentally, maybe on purpose
and so Sarbanes-Oxley has a lot of requirements
on those who process and hold this information
so the auditors on the outside,
because this is a publicly traded firms,
they wanna be able to come in
and look at that information and make sure
you're doing everything legal and by the book.
The name we talk about, applies to colleges
and educational institutions, it's called FERPA.
It's the Family Educational Rights and Privacy Act.
This one is gonna require educational institutions
to implement security and privacy
controls for educational records.
This means that the students can get access to the records,
the teachers can get access to the records,
but nobody else should.
So if you have a 19 year old college student,
that 19 year old is entitled to their privacy,
even their parent, even if the parent
is paying for their education,
cannot gain access to that data
without the student's permission.
That's part of FERPA as well, so that applies
to any colleges, universities and educational institutions.
Now, the next one we talk about, is not a law.
All those we've talked about so far,
were legal regulations, this one
is just a policy regulation made by the credit card industry
and it's called, PCI DSS, we've mentioned it before.
Payment Card Industry Data Security Standard.
Its rules are about storage, processing and transmission
of credit and debit card information.
This is not a law, but a contractual obligation,
if you're gonna process credit card information
or hold data information, VISA and MasterCard says,
you must follow PCI DSS rules.
Now why is that such a big deal here in CSA?
Because it does have an angular requirement
for an external audit and so it does say
that servers carrying analysts
have the audit on the outside by
third party independent vendor
to make sure your organization is compliant with their rules
or, you can lose the ability to take credit cards.
The next one I'm gonna talk about is,
under state law and there's a lot of different states
in the United States, there's 50 of them
and there is Data Breach Notification laws.
Some states have them, some states don't
but most have passed them by this point.
And each one is different, this requires companies
to notify victims of data breaches
in a timely manner, so for instance,
Equifax breach happened recently,
Duke Energy had a data breach recently.
And they have to notify their customers
in a timely manner so that customers can protect themselves
from their personal information being put out there.
Again, we're not gonna cover each and every state law,
but just know that data breach notification laws
do exist at this time.
Now, that's the idea for the CSA+ exam.
Now the question is, how much of that
information do you need to know.
You need to know, if I say Sarbanes-Oxley,
that it applies to a publicly traded financial institution.
If I say, FERPA, you should know
I'm talking about education.
If I'm talking about HIPPA, you need to know
I'm talking about healthcare.
If you know that level of depth,
you'll do fine on test day.