Gramm-Leach-Bliley Act (GLBA): Federal law that requires financial institutions to explain their information-sharing practices to customers and protect sensitive data
Health Insurance Portability and Accountability Act (HIPAA): Federal law establishing national standards for electronic healthcare transactions and protecting medical information security
Federal Information Security Management Act (FISMA): Law requiring federal agencies to develop and implement information security programs and risk assessments
Sarbanes-Oxley Act (SOX): Federal law requiring public companies to establish internal controls and procedures for financial reporting, including IT systems security
Federal Trade Commission Act (FTC Act): Broad consumer protection law that has been applied to data security and privacy practices of organizations
PCI DSS: Payment Card Industry Data Security Standard - Security standard for organizations that handle credit card transactions
NIST Cybersecurity Framework: Voluntary framework of computer security guidance for organizations to better manage and reduce cybersecurity risk
ISO 27001/27002: International standards providing best practice recommendations for information security management systems
California Consumer Privacy Act (CCPA): State law providing California residents with rights regarding their personal information and imposing data protection obligations on businesses
New York SHIELD Act: State law requiring businesses to implement safeguards for the private information of New York residents and expand data breach notification requirements
State Data Breach Laws: Various state-specific laws requiring notification of security breaches involving personal information
SEC Cybersecurity Guidance: Securities and Exchange Commission guidance on disclosure obligations relating to cybersecurity risks and incidents
NIST SP 800-53: Security and privacy controls standard for federal information systems and organizations
NIST SP 800-30: Guide for conducting risk assessments of federal information systems and organizations
Industry-Specific Requirements: Sector-specific regulations and compliance requirements that vary by industry (healthcare, finance, education, etc.)
