Cyberstudy
PDF p.379 In progress Not in the PDF's table of contents

Regulations and National, Local, Regional, and Industry Laws

Open PDF at p.379 10 flashcards

Summary

PDF p.379

Organizations must comply with various national, local, regional, and industry-specific laws to protect data and ensure cybersecurity. These laws vary significantly but influence cybersecurity programs.

In plain words

Supplementary — not from your PDF

Organizations face national laws (HIPAA, GLBA, FISMA in the US; the Data Protection Act and NIS Regulations in the UK; PIPEDA in Canada), local and regional laws (New York DFS Part 500, Massachusetts 201 CMR 17.00), and industry-specific laws (HIPAA for healthcare, GLBA and PCI DSS for finance, CALEA for telecoms, NERC for energy, FERPA/COPPA for education and children, FISMA/CJIS for government).

Detailed explanation

PDF p.379
  • National Laws
    • Examples: HIPAA, GLBA, FISMA (US); Data Protection Act 2018, NIS Regulations 2018 (UK); PIPEDA (Canada); Information Technology Act 2000 (India); Privacy Act 1988 (Australia).
  • Local and Regional Laws
    • Examples: New York DFS Part 500 Cybersecurity Regulation, Massachusetts 201 CMR 17.00.
  • Industry-Specific Laws
    • Healthcare: HIPAA, GDPR.
    • Financial Services: GLBA, PCI DSS.
    • Telecommunications: CALEA.
    • Energy: NERC.
    • Education & Children: FERPA, CIPA, COPPA.
    • Government: FISMA, CJIS Security Policy, GSC.

Important terms

taken from the text above
Healthcare
HIPAA, GDPR.
Financial Services
GLBA, PCI DSS.
Telecommunications
CALEA.
Energy
NERC.
Education & Children
FERPA, CIPA, COPPA.
Government
FISMA, CJIS Security Policy, GSC.

Examples & real-world scenarios

Supplementary — not from your PDF
  • A hospital following HIPAA.
  • A bank following GLBA and PCI DSS.
  • A school following FERPA.

Scenario

A financial firm operating in New York must meet both the federal GLBA and the state's DFS Part 500. Compliance programmes have to cover multiple overlapping laws.

Common mistakes

Supplementary — not from your PDF
  • Assuming one national law covers every obligation.
  • Overlooking industry-specific or state laws.

Practical skills

Supplementary — not from your PDF
  • Match an industry to the laws that apply to it.

What I should remember

Key Points PDF p.379
  • National Laws: Vary by country.
  • Local and Regional Laws: Specific to states or cities.
  • Industry-Specific Laws: Govern data handling and protection.