Computer Fraud and Abuse Act (CFAA): Federal law that prohibits accessing a computer without authorization or exceeding authorized access. Must be considered for defining acceptable use and unauthorized access provisions.
Electronic Communications Privacy Act (ECPA): Federal law governing the interception of electronic communications. Relevant for policies regarding email monitoring and electronic communication privacy.
Stored Communications Act (SCA): Federal law protecting stored electronic communications. Important for policies regarding data storage and access to stored communications.
Digital Millennium Copyright Act (DMCA): Federal copyright law addressing digital content and technology. Relevant for policies on software usage, digital content handling, and copyright compliance.
Children's Internet Protection Act (CIPA): Federal law requiring protection measures to block harmful content for minors. Applicable if the organization works with children or educational institutions.
Health Insurance Portability and Accountability Act (HIPAA): Federal law protecting medical information privacy. Must be included if the organization handles healthcare data or patient information.
Gramm-Leach-Bliley Act: Federal law requiring financial institutions to protect customer data. Relevant if handling financial information or working with financial institutions.
Federal Trade Commission Act: Federal law governing fair business practices, including data privacy and security requirements for protecting consumer information.
State Data Breach Notification Laws: Various state-specific requirements for notifying individuals affected by data breaches. Must comply with laws in all states where the organization operates.
State Privacy Laws: State-specific privacy regulations like CCPA (California) and SHIELD Act (New York). Requirements vary by state and must be incorporated based on operational jurisdiction.
PCI DSS: Payment Card Industry Data Security Standard - Guidelines for organizations handling credit card data. Mandatory if processing payment card transactions.
FERPA: Family Educational Rights and Privacy Act - Federal law protecting student education records. Must be included if organization is an educational institution or handles student data.
National Labor Relations Act: Federal law protecting workers' rights. Relevant for policies regarding employee monitoring and communication surveillance.
Americans with Disabilities Act: Federal law requiring accessibility accommodations. Must be considered for computer system accessibility requirements and reasonable accommodations.
GDPR: European Union's General Data Protection Regulation. Must be considered if the organization handles data of EU residents or operates in EU markets.
