GLBA (Gramm-Leach-Bliley Act): Federal law that requires financial institutions to explain their information-sharing practices to customers and protect sensitive data.
HIPAA (Health Insurance Portability and Accountability Act): Federal law that sets national standards for the protection of individuals' medical records and other personal health information.
FISMA (Federal Information Security Management Act): Law that defines a comprehensive framework to protect government information, operations, and assets against natural or human threats.
CFAA (Computer Fraud and Abuse Act): Federal law that criminalizes unauthorized access to computers and networks, affecting how security testing and monitoring can be conducted.
ECPA (Electronic Communications Privacy Act): Federal law governing the interception of digital and electronic communications, relevant for network monitoring and security operations.
COPPA (Children's Online Privacy Protection Act): Federal law that imposes specific requirements for collecting and handling personal information from children under 13.
FTC Act: Federal law that prohibits unfair or deceptive practices affecting commerce, including inadequate cybersecurity measures.
State Data Breach Laws: Individual state laws requiring notification of security breaches involving personal information, with varying requirements across all 50 states.
NY SHIELD Act: New York state law requiring businesses to implement safeguards for the protection of private information and expanding breach notification requirements.
CCPA (California Consumer Privacy Act): California law providing residents with rights regarding their personal information and imposing obligations on businesses handling such data.
VCDPA (Virginia Consumer Data Protection Act): Virginia's comprehensive privacy law giving residents rights over their personal data and requiring businesses to meet specific obligations.
Colorado Privacy Act: Colorado's privacy law establishing requirements for data protection and giving residents rights over their personal information.
NIST Cybersecurity Framework: Voluntary framework of computer security guidance for organizations to better manage and reduce cybersecurity risk.
ISO 27001/27002: International standards providing requirements and guidelines for establishing, implementing, maintaining, and improving information security management.
PCI DSS: Payment Card Industry Data Security Standard setting requirements for organizations that handle credit card data.
SEC Cybersecurity Guidelines: Securities and Exchange Commission guidance on cybersecurity risks and incident disclosure requirements for public companies.
FTC Privacy and Security Guidelines: Federal Trade Commission guidelines providing recommendations for businesses on maintaining reasonable data security and privacy practices.
GDPR: European Union's General Data Protection Regulation that may apply when handling EU residents' data, even for US companies.
