Laws & Regulations

Question 1

what is PCI DSS?

Answer 1

is a set of rules created by a group of credit card issuers for processing credit card transactions. The standard defines requirements for a security program, specific criteria for protecting data and necessary security controls.

Question 2

Types of compliance controls?

Answer 2

• Physical controls mitigate risks to physical security. These controls usually physically prevent or deter unauthorized access to or through specific area.
• Administrative controls mitigate risks by implementing certain processes and procedures. Whenever you accept, avoid, or transfer risk, you are likely using administrative controls because you’re using processes, procedures, and standards in place to prevent your organization from hurting itself by taking on too much risk. Documenting your administrative controls by keeping records of policies, procedures, and standards is necessary to prove you follow them.
• Technical Controls manage risks using technical measures. You might mitigate risks by putting firewalls, intrusion detection systems, access control lists, and other technical measures in place to prevent attackers from getting into your system.

Question 3

4 maintaining compliances stages?

Answer 3

Monitor -> review -> document -> report

Question 4

HIPAA

Answer 4

Health Insurance Portability and Accountability Act

Question 5

SOX

Answer 5

Sarbanes-Oxley Act. It regulates financial data, operations, and assets for publicly held companies.

Question 6

GLBA

Answer 6

Gramm-Leach-Blieley Act. It aims to protect information such as PII(personally identifiable information) and
financial data belonging to customers of financial institutions. GLBA defines financial institution broadly to include “banks, savings and loans, credit unions, insurance companies and
securities firms…some retailers and automobile dealers that collect and share
personal information about customers to whom they extend or arrange credit” as well as businesses that use financial data to collect debts from customers.

Question 7

CIPA

Answer 7

Children’s Internet Protected Act. It requires schools and libraries to prevent children from accessing harmful and obscene content.

Question 8

COPPA

Answer 8

Children’s Online Privacy Protection Act. their PII. It requires the organizations to post a privacy policy online, make reasonable efforts to obtain parental consent, and notify parents that information is being collected.

Question 9

FERPA

Answer 9

Family Educational Rights and Privacy Act. It protects students’ records. FERPA applies to students at all levels and when the student turns 18, the rights to these records shift from the parents to the students.

Question 10

Types of Compliance

Answer 10

-Regulatory compliance is adherence to the laws specific to the industry in which you are operating.
- Industry compliance is adherence to regulations that aren’t mandated by law but that can nonetheless have severe impacts upon your ability to conduct business.

Question 11

FISMA

Answer 11

Federal information Security Management Act. It applies to all US federal government agencies, all state agencies that administer federal
programs (such as Medicare) and all private companies that support, sell to, or
receive grant money from the federal government.

Question 12

FedRAMP

Answer 12

Federal Risk and Authorization Management Program. It defines rules for government agencies contracting with cloud providers. This applies to
both cloud platform providers such as AWS and Azure and companies providing
software as a service (SaaS) tools that are based in the cloud.