Section 4: Policies and Frameworks

Question 1

HIPAA

Answer 1

Health Insurance Portability and Accountability Act (HIPAA)
▪ Affects healthcare providers, facilities, insurance companies, and medical data clearing houses

Question 2

Sarbanes-Oxley (SOX)

Answer 2

Publicly traded U.S. corporation are affected by this regulation and must follow certain accounting methods and financial reporting

Question 3

GLBA

Answer 3

Affects the security of personal identifiable information, prohibits sharing financial information with any third-parties, and provides guidelines for securing that financial information

Question 4

FISMA

Answer 4

Federal Information Security Management Act of 2002 (FISMA)
▪ Affects federal agencies and require them to develop, document, and implement an agency-wide information systems security program

Question 5

FERPA

Answer 5

Family Educational Rights and Privacy Act (FERPA)
▪ A federal law that protects the privacy of student education records

Question 6

COPPA

Answer 6

o Children’s Online Privacy Protection Act (COPPA)
▪ Imposes certain requirements on websites owners and online services that are directed to children under 13 years of age
▪ COPPA can put a ton of extra requirements on companies trying to serve younger markets with educational content

Question 7

GDPR

Answer 7

General Data Protection Regulation (GDPR)
▪ It states that personal data cannot be collected, processed or retained without the individual’s informed consent
▪ GDPR provides a provision in the law to ensure a user has the right to withdraw their consent at any time

Question 8

SLA

Answer 8

This agreement is concerned with the ability to support and respond to problems within a given timeframe while providing the agreed upon level of service to the user

Question 9

MSA

Answer 9

This is an agreement for future agreements, allowing the organizations involved to negotiate future contracts much more quickly since they can reference the Master Service Agreement

Question 10

NDA

Answer 10

Signed between two parties and define what data is considered
confidential and cannot be shared outside of the relationship

Question 11

MOU

Answer 11

A non-binding agreement between two or more organizations to detail an intended common line of action

Question 12

BPA

Answer 12

Conducted between two business partners and establishes the conditions of their relationship