- [Instructor] While we typically develop
security programs for the purpose
of safeguarding the confidentiality, integrity,
and availability of our information,
we also often face external requirements
to build security controls.
Compliance programs ensure that an organization's
security controls are consistent with a variety
of laws, regulations, and standards
that govern organizations.
There are a wide variety of compliance obligations
facing modern enterprises and these obligations
differ depending upon the geographic location
of the organization and it's industry.
A university in the United States
has far different compliance requirements,
for example, than a retail merchant in Europe.
Both organizations may face a significant compliance
burden, but the details will vary.
Security training programs should include
coverage of the specific compliance obligations
facing an organization as well as the responsibilities
of individual employees to ensure continued compliance.
For example, if a law requires that employees
never write down credit card numbers,
the organization security awareness program
should educate them about this requirement.
There are three different types of compliance obligations
that should be covered in an organizations
security awareness and training program.
Laws are requirements passed by a governmental
authority at the national or local level.
They come with civil and criminal penalties
for failure to comply.
For example the Gramm-Leach-Bliley Act or GLBA,
affects security practices of financial institutions.
The Gramm-Leach-Bliley Act requires that financial
institutions designate an information security officer
and build a formal information security program
to protect customer information.
Regulations are mandatory requirements
that an organization must follow
but are not embodied in law.
Some regulations come from government agencies
carrying out other laws, such as this HIPPA security rule
that describes how the U.S. government
expects health care providers will comply
with health insurance portability
and accountability act or HIPPA.
While HIPPA is a law, this security rule
is a government regulation.
Other regulations come from non-governmental authorities.
For example, a contract between two organizations
might include detailed security requirements
and include financial penalties for non-compliance.
Standards are detailed, technical specifications
for security and other controls.
Organizations may be required to comply with standards
by contract or regulation.
For example, the payment card industry data security
standard, or PCIDSS is a standard that merchants
handling credit card information must follow
due to language in their contract
with credit card merchant banks.
The good news is that these laws, regulations,
and standards often just formulize security
best practices that an organization should
already be following.
The best way to begin a compliance effort
is conducting a gap analysis that determines
the areas where and organization may need
to beef up controls to become compliant.