Data Structure
Networking
RDBMS
Operating System
Java
MS Excel
iOS
HTML
CSS
Android
Python
C Programming
C++
C#
MongoDB
MySQL
Javascript
PHP
Physics
Chemistry
Biology
Mathematics
English
Economics
Psychology
Social Studies
Fashion Studies
Legal Studies
- Selected Reading
- UPSC IAS Exams Notes
- Developer's Best Practices
- Questions and Answers
- Effective Resume Writing
- HR Interview Questions
- Computer Glossary
- Who is Who
What are the Legal Requirement for Cyber Security?
The various requirements for cyber security can be seen especially in the United States Cybersecurity regulations are divided into regulations in the federal government, the state government, and various proposed regulations. Cybersecurity frameworks, which are not codified in law but are produced and/or enforced by non-governmental bodies, are an essential distinction.
The NIST or ISO 27001 cybersecurity frameworks, for example, are widely used standards in a variety of enterprises and government agencies. Industry dynamics or organizational alliances with government or other agencies may compel companies to follow these principles. However, not all firms have these certification and cybersecurity procedures written under law.
Federal Regulations
Few federal cybersecurity rules exist, and those that exist are focused on specialized businesses. The 1996 Health Insurance Portability and Accountability Act (HIPAA), the 1999 Gramm-Leach-Bliley Act, and the 2002 Homeland Security Act, which incorporated the Federal Information Security Management Act, are the three key cybersecurity rules (FISMA). Healthcare companies, financial institutions, and federal agencies are all required to secure their systems and information under the three standards.
Gramm Leach Billey Act of 1999 (Also Known as GLBA)
This legislation applies to businesses that have access to private and personal financial information. This law establishes guidelines for who has access to the information and how it is handled and gathered. Because these entities handle a lot of sensitive information, cyber security experts are frequently employed to implement safeguards and ensure no dangers or threats arise.
The Health Insurance Portability and Accountability Act of 1996 (Commonly Known as HIPPA)
Companies with access to sensitive medical information, such as a hospital or clinic, are subject to this cyber security regulation. The medical institution must comply with the legislation by declaring how the information is shared and preserved. This is crucial for people who work in a cybersecurity firm—those outsourced for labor at a medical facility, in particular.
The security rule outlines a covered entity's obligations to implement appropriate technological and other protections to secure protected health information (PHI) and electronically protected health information (ePHI) (ePHI). As proven by Premera Blue Cross in the example below, healthcare-related businesses confront continual cybersecurity risks that might result in costly lawsuits. Any company that utilizes or has access to patient data may prevent costly legal fees and reputational damage by taking the required precautions ahead of time.
The Children's Online Privacy Protection Act of 1998
The Children's Online Privacy Protection Act (COPPA) is designed to safeguard children under the age of 13 by allowing their parents to regulate how their data is shared. If a website or internet service is aimed towards children under the age of 13, it must adhere to specific guidelines. This includes any service created for children to use, such as websites, apps, online video games, and any other service that incorporates an internet connection. Providers of these services must adhere to strict guidelines while interacting with their young customers. Businesses trying to comply with COPPA might use the materials provided by the Federal Trade Commission.
Cyber Security Information Sharing Act (Also Known as CISA) of 2015
This cyber security law encourages computer businesses and the government to exchange data so that dangers may be recognized and addressed more quickly. This legislation is crucial for companies that handle a lot of personal information. Because cyber security professionals are now engaged in various industries, it is critical. As a result, they'll need to know how to deal with any hazards that occur.
State Regulations
State governments have sought to enhance cybersecurity by making companies with inadequate security more visible to the public. California established the Notice of Security Breach Act in 2003, requiring any organization that keeps personal information about California residents and has a security breach to notify the specifics of the incident. Name, social security number, driver's license number, credit card number, or financial information are examples of personal information.
California Consumer Privacy Act of 2018 (Also Known As CCPA)
There has been a lot of cyber security legislation proposed to the government in the last few years. The California Consumer Privacy Act of 2008 is one such example (commonly known as the CCPA), which was enacted in response to the EU's GDPR legislation. To be eligible for the CCPA, a firm must either collect/share personal information from over 50,000 people annually, produce annual gross sales of over $25 million, or receive more than 50% of its annual profits from selling the residents' personal information.
This law, postponed until at least 2020, must be followed by both California-based and out-of-state agencies. It affects both those who handle and collect personal information from California citizens and those who do business in the state.
Department of Financial Services, New York State Regulations on Cybersecurity
The New York State Department of Financial Services (NYDFS) has a number of rules and regulations that apply to financial and associated institutions throughout the state. These principles govern a wide range of subjects, including risk assessments and paperwork. Credit unions, health insurance, investment companies, licensed lenders, and mortgage brokers are among the businesses affected by these rules.
The California Privacy Rights and Enforcement Act (California Privacy Rights and Enforcement Act (CPRA)
The CPRA, also known as the CCPA 2.0, was just ratified by California voters and will go into effect in January 2023. This new rule imposes even more strict standards on businesses regarding data protection. Any business that reaches specific thresholds will be required to comply with this law. These benchmarks include the number of customer records gathered or exchanged and how the data is used. The law established a new category of protected data known as sensitive personal information (SPI).
The Stop Hacking and Improve Electronic Data Security (SHIELD) Act of 2019 was passed in New York.
The SHIELD act in New York mandates that any corporation doing business in the state maintain sufficient administrative, technological, and physical protections for personal data it collects. The legislation specifies the definitions and regulations for what comprises personal information and how businesses can comply with each of these three categories.
295 Views
