Essay on Security Regulation Compliance

The GLB Safeguard Rule requires that financial institutions develop security programs to protect data; they also must provide provisions to protect customer’s information and it requires institutions to give customers a written privacy notices that explain how their information is shared.

If you have ever bought something over the internet and used a credit card you may not have thought how secure is my information? Is this vendor someone I can trust with my credit card number? Will they inform me if my information is lost or stolen by them? These questions and many more can be answered by the Payment Card Industry Data Security Standard (PCI DSS). The PCI DSS compliance requirements are strictly enforced by the payment card brands to all merchants who transmit, store, or process credit card information. The main goals or objectives of PCI DSS are: build and maintain a secure network that is PCI compliant; protect cardholder data; maintain a vulnerability management program; implement strong access control measures; regularly

As a principal part of the Gramm-Leach-Bliley (GLB) Act, the Financial Privacy Rule (or Privacy Rule) revolves around protecting the privacy of consumer information and sets the standards for privacy notices, opt-out notices, and how nonpublic personal information can be used or disclosed. (FTC)

data. This allows people to control their own personal data but the act mostly does not apply to

In 1984, the CFAA began as a criminal statute to protect classified information in government computer systems. The statute, initially, was restricted to “federal interest computers,” which included only computers of governmental and financial institutions. Throughout the years, Congress progressively expanded its reach, both in terms of who may file suit and what computers are protected. In 1994, Congress added, for the first time, a private right of action to allow “[a]ny person who suffers damage or loss by reason of a violation of [the statute]” to “maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief.” Further amendments in 1996 extended the range of the CFAA from “federal interest computers” to “protected computers” used in interstate commerce.

Congress passed the Foreign Intelligence Surveillance of Act of 1978 (FISA), with aims of curving the foreign intelligence abuses that occurred under the Nixon and Johnson administrations. This also established the Foreign Intelligence Court (FISC) to review applications for surveillance, search orders, and the like. In 2001, after the September 11th attacks, Congress amended FISA in what is now called the Patriot Act.

Federal Information Security Management Act (FISMA) – This refers to a U.S. law that was enacted in 2002 to lay down a comprehensive framework on how government information are protected. This also relates to operations and assets against natural or man-made threats. This act assigns responsibilities to federal agencies that re responsible for system and data protection, ensuring that all elements of FISMA are complied to, and integration of security measures throughout federal agencies in cost-effective, timely and efficient manner (. FISMA regulations require that inspection of the agencies be done annually through an independent evaluation (Gibson, 2010, pg. 59). The evaluation seeks to test the effectiveness of policies and practices in agencies and compile a report that identifies the state of compliance of that agency.

In a highly competitive market space, being compliant with PCI standards will make our organization more acceptable in the market, and also help build trust and confidence in our operation among healthcare providers seeking our services. In a constantly evolving threat environment with increased levels of data breaches in recent times, ensuring PCI compliance even though not mandated will help attract customers and would be good return on investment. Along with BAA signed with our clients, being PCI compliant would also ensure extra layer of protection by following the practices suggested by leading payment card brands like Visa, Mastercard, etc. who are constantly looking out for new emerging threats in the industry, and are proactive in incorporating changes to PCI DSS standards to minimize the impact of these new threats. Though complying with standards like PCI doesn’t ensure security, they provide a structure around which organizations can build their information security and assurance program, thereby helping them anticipate and mitigate new risks in the area of storing payment card

According to Kim & Solomon (2014), PCI DSS affects any organization that processes or stores credit card information. The PCI DSS is a comprehensive security standard that includes requirements for security management, policies, procedures, network architecture, software design, and other critical protective measures. GLBA requires that financial institutions provide their clients a privacy notice that explains what information the company gathers about the client, where the information is

GLB: The Gramm-Leach-Bliley Act (GLB Act or GLBA), also known as the Financial Modernization or Budgetary Modernization Act of 1999, is a federal law ordered in the United States to control the ways that financial institutions deal with the private information of individuals.

The Freedom of Information Act was enforced when our government realized the importance of the relationship between access to information and government accountability. This act enables citizens to view a plethora of different files and records from government agencies. This act proved to be “a principal instrument for breaking down bureaucratic secrecy in American public administration” (p. 62).

Finally, in 2004 major card industries such as JCB, VISA and MasterCard formed a regulatory body and set of rules to govern the card industries, no matter if their small or large business joins. Subsequently, in 2005, the standard became mandatory to be followed by all card industries and became known as PCI DSS standard and now PCI standard. It applies to all companies that stores, processes or transmits cardholder information Card, and mail / phone order.

Enacted on July 4, 1966, the Freedom of Information Act (FOIA) provides any person with the right, enforceable in court, to obtain access to federal agency records, except to the extent that such records are protected from public disclosure by one of nine exemptions, or one of three special law enforcement record exclusions. Requests can be made for any agency record, and as recognized by Congress, numerous presidents and the Supreme Court, the FOIA is an important tool of

Establishing an effective Information Technology Security Policy Framework is critical in the development of a comprehensive security program. The purpose of the Information Security Policy Framework is to insure your organization will be able to provide the minimum security level necessary to maintain confidentiality, integrity, and availability of the information it collects and uses.

Securities regulations began in 1933 as a reaction to securities market violations. Securities regulations are a balance of investor and issuer interests. Regulations have typically been enacted in reaction to a violation that affects many, including issuers, investors, and the public. These regulations are not only created in reaction to violations, but the legislature also attempts to take a bigger step in prevention of the same violation reoccurring, as well as preventing a violation that has yet to occur. In other words, securities regulations have always been on a mission to stay one step ahead of securities violations from both issuers and investors. Regulations tend to tighten the rules to ensure investors and issuers do not have