Cybersecurity Information Sharing Act (CISA): Federal law enacted in 2015 that promotes sharing of cyber threat information between private sector and government while providing liability protection for companies.
National Security Act: Fundamental law providing the framework for U.S. national security and intelligence operations, affecting how sensitive security information can be shared.
Federal Information Security Management Act (FISMA): Defines framework for protecting government information, operations and assets against threats, relevant for agreements involving federal entities.
Privacy Act of 1974: Establishes code of fair information practices governing collection, maintenance, use, and dissemination of personal information maintained by federal agencies.
Computer Fraud and Abuse Act (CFAA): Federal cyber security law that criminalizes unauthorized access to protected computers and networks, affecting how security information must be handled.
State Data Privacy Laws: Various state-specific regulations like CCPA (California) and SHIELD Act (New York) governing data privacy and security requirements.
GDPR Considerations: While not U.S. law, must be considered if European data is involved in the security sharing agreement.
HIPAA: Federal law protecting sensitive patient health information, must be considered if healthcare data is involved in security sharing.
Gramm-Leach-Bliley Act: Requires financial institutions to explain information-sharing practices and protect sensitive data, relevant for financial sector agreements.
Sarbanes-Oxley Act: Mandates strict financial disclosure and corporate governance requirements for public companies, affecting their information sharing practices.
PCI DSS: Security standard for organizations handling credit card information, relevant if payment data is part of sharing agreement.
Defend Trade Secrets Act: Federal law providing uniform protection for trade secrets, crucial for protecting proprietary information in sharing agreements.
Critical Infrastructure Information Act: Protects critical infrastructure information shared with the government, essential for agreements involving critical infrastructure sectors.
Export Administration Regulations (EAR): Controls export of dual-use items including certain types of information and technology, affecting international sharing agreements.
International Traffic in Arms Regulations (ITAR): Controls export and import of defense-related articles and services, including technical data, relevant for defense-related sharing.
Uniform Commercial Code: Provides standardized rules for commercial transactions, including provisions affecting contractual relationships and information sharing.
