Maintaining Compliance

Objectives

• What compliance is
• What US-based laws related to compliance exist
• What some relevant regulations related to compliance are
• What organizational policies for compliance should be
considered
• What standards and guidelines for compliance exist

http://fpt.edu.vn 16/05/2019 2
 Compliance

• Companies affected by the laws are expected to comply with

the laws
– commonly referred to as compliance
• To ensure the companies remain in compliance with
relevant laws and regulations
– internal audits
– external audits

http://fpt.edu.vn 16/05/2019 3
 US-based Laws

• Federal Information Security Management Act (FISMA)

2002
• Health Insurance Portability and Accountability Act (HIPAA)
1996
• Gramm-Leach-Bliley Act (GLBA) 1999

http://fpt.edu.vn 16/05/2019 4
 US-based Laws (cont.)

• Sarbanes-Oxley Act (SOX) 2002

• Family Educational Rights and Privacy Act (FERPA) 1974
• Children’s Internet Protection Act (CIPA) 2000

http://fpt.edu.vn 16/05/2019 5
 Regulations Related to Compliance

• Securities and Exchange Commission (SEC)

• Federal Deposit Insurance Corporation (FDIC)
• Department of Homeland Security (DHS)

http://fpt.edu.vn 16/05/2019 6
 Regulations Related to Compliance (cont.)

• Federal Trade Commission (FTC)

• State Attorney General (AG)
• U.S. Attorney General (U.S. AG)

http://fpt.edu.vn 16/05/2019 7
 Organizational Policies for Compliance

• Fiduciary responsibility (important)

• Mandatory vacations
• Job rotation
• Separation of duties
• Acceptable use

http://fpt.edu.vn 16/05/2019 8
 Standards and Guidelines for Compliance

• Payment Card Industry Data Security Standard (PCI DSS)

• National Institute of Standards and Technology (NIST)
• Generally Accepted Information Security Principles (GAISP)

http://fpt.edu.vn 16/05/2019 9
 Standards and Guidelines for Compliance (cont.)

• Control Objectives for Information and related Technology

(COBIT)
• International Organization for Standardization (ISO)
• International Electrotechnical Commission (IEC)

http://fpt.edu.vn 16/05/2019 10
 Basic COBIT Principle

http://fpt.edu.vn 16/05/2019 11
 Standards and Guidelines for Compliance (cont.)

• Information Technology Infrastructure Library (ITIL)

• Capability Maturity Model Integration (CMMI)
• Department of Defense (DoD) Information Assurance
Certification and Accreditation Process (DIACAP)

http://fpt.edu.vn 16/05/2019 12
 ITIL Life Cycle

http://fpt.edu.vn 16/05/2019 13