There are a number of additional U.S. and international standards that impact data security management and regulatory compliance. Rather than react to individual regulations, we advise our clients to implement one comprehensive security plan that takes into account all of the applicable laws.
GLBA
The Gramm-Leach-Bliley Act (GLBA) directly impacts financial institutions in the United States. The act’s Privacy Rule requires financial institutions to ensure the security and confidentiality of customer records and information. The Safeguards Rule, which is enforced by the Federal Trade Commission, requires financial institutions to have a security plan to protect the confidentiality and integrity of personal consumer information. A number of companies have been prosecuted recently for being out of compliance.
FISMA
The Federal Information Security Management Act, or FISMA, is a U.S. federal law designed to ensure the effectiveness of security controls over information resources that support federal government operations and assets. The act mandates yearly audits - the results of which are provided to the Office of Management and Budget. The National Institute of Standards and Technology (NIST) supports FISMA by developing publications that provide guidance and best security practices to government agencies, including Special Publication 800-53, “Recommended Security Controls for Federal Information Systems.” BASELII
The Basel II accord, created by the Basel Committee on Banking Supervision, deals in part with the international standards for measuring the adequacy of a bank's capital. Its goal is to provide greater consistency in the way banks and banking regulators approach risk management across national borders. The accord requires banks to measure and control credit, market, and operational risks, including information security. Banks that comply with Basel II are allowed to maintain smaller capital reserves, which can be a key competitive advantage. Much like Sarbanes-Oxley compliance in the United States, banks need to demonstrate adequate controls over information systems that store and serve financial data.
|
