Section 3: Security Governance and Compliance Flashcards
Due Care
Reasonable efforts made by an organization to prevent harm to individuals or assets
Encompasses the responsibility of an organization to protect its stakeholders from foreseeable risks, including implementing appropriate security measures that align with industry standards and best practices
Due Diligence
Activities used to ensure compliance with due care
Researching requirements and ensure due care obligations remain compliant with organization requirements
Requires ongoing assessments and evaluations of security practices to identify gaps and make necessary improvements
FTC Act
Federal Trade Commission Act protects consumers from unfair competition or deceptive acts or practices that affect commerce- includes the protection of PII
GLBA
Gramm-Leach-Bliley Act focuses on safeguarding financial data and prevent sharing to third party organizations without customer consent
ECPA
Electronic Communications Privacy Act
Defines the collection of electronic communications and defines how the US government can access it
HIPAA
Health Insurance Portability and Accountability Act
Creates federal requirements for the collection, management, and protection of certain health related information
HITECH
Health Information Technology for Economic and Clinical Health Act
Mandates how organizations must handle PHI on behalf of a HIPAA covered entity
GINA
Genetic Information Non-Disclosure Act
Protects individuals from the unauthorized use, disclosure, or sale of genetic related information
SOX
Sarbanes-Oxley Act
Protects investors against accounting fraud and requires the reporting of financial information to company investors
PCI DSS
Payment Card Industry Data Security Standard
Global payment card industry standard aimed at protecting credit card theft and fraud of the cardholder
PCI DSS Requirements
Install and maintain firewall
Do not use vendor supplied default credentials for systems
Protect stored cardholder data
Encrypt transmission of cardholder data across open, public networks
Protect all systems against malware and regularly update AV software or programs
Develop and maintain secure systems and applications
Restrict access to cardholder data by business need-to-know
Identify and authenticate access to system components
Restrict physical access to cardholder data
Track and monitor all access to network resources and cardholder data
Regularly test security systems and processes
Maintain a policy that addresses information security for all personnel
GDPR
General Data Protection Regulation (European Union)
Went into effect 2018
Increased scope of previous data privacy regulations
Controller (GDPR)
Person, public authority, agency or other body which determines the purposes and means of the processing of personal data
Processor (GDPR)
Person, public authority, agency, or other body which processes personal data on behalf of the controller
GDPR Subject Rights
Access to any collected information
Rectification (update or correct) information
Erasure or “to be forgotten”
Restriction of processing and how the data is used
Data portability to reuse the data as subject sees fit
Object to any further processing
