Compliance, Laws, Regulations Flashcards
What does (FISMA) stand for?
Federal Information Security Management Act
What does (FedRAMP) stand for?
Federal Risk and Authorization Management Program
Where does FISMA apply to?
It applies to all US Federal and State Government Agencies That administer federal programs such as Medicare and all private companies that support, sell, or receive grant money from federal government
Federal Risk and Authorization Management
This applies to SAAS tools and Cloud platform providers like AWS and AZURE
ATO
Authority To Operate
What does (HIPAA) Stand for?
The Health insurance portability and accountability act
Founded at (1996)
What does (PHI) Stand for?
Protected health information
Sarbanes-Oxley Act (SOX) (founded 2002)
Regulates financial data, operation, and assets for publicly held companies
Gramm-Leach-Bliley Act (GLBA)
Protects information Such as Personally identifiable information (PII).
Children’s Internet Protection ACT (CIPA)
Requires schools and libraries to prevent children from accessing obscene or harmful content over the internet
Children Online Privacy Protection Act (COPPA)
Protects the privacy of minors younger than 13 by restricting organizations from collecting their PII
The Family Educational Rights and Privacy Act (FERPA) was founded 1974
Insures to protect students at all levels once turned 18. The rights to these records shift from parent to student
General Data Protection Regulation (GDPR) European Union 2018
covers data protection and privacy for all individuals in the European Union
Payment Card Industry Data Security Standard (PCI DSS)
an information security standard designed to protect cardholder data and reduce fraud and data breaches across the payment ecosystem
International Organization for Standardization (ISO) Created in 1926
covers technology, Food safety, and agriculture
SP 800-37 Framework
- Categorize
- Select
- Implement
- Assess
- Authorize
- Monitor
(SAAS)
Software as a service (EX: Provides access to a specific application or application suite like google Apps)
(PAAS)
Platform as a service (EX: Database or web server like azure)
(IAAS)
Infrastructure as a service (EX, Virtual Servers and storage like Google Cloud and Amazon web services)
NIST
National institute of standards and technology
Health Information Technology for Economic and Clinical Health Act (HITECH)
Legislation enacted as part of the American Recovery and Reinvestment Act 2009. HITECH aims to promote the adoption and meaningful use of health information technology (health IT) in the United States.
what does due care mean
Often called prudent man rule, which is doing what any responsible person would do
Define due diligence
The management of due care ensuring the implemented security measure was done correctly
Define Gross negligence
The opposite of due care and suffering a negative loss, you can be legally held liable
Human intelligence (Humint)
Any Data that was gathered by talking to people
