Computer Fraud and Abuse Act (CFAA): Federal law that criminalizes unauthorized access to computer systems and networks, setting the foundation for access control requirements
Electronic Communications Privacy Act (ECPA): Federal legislation protecting electronic communications during transmission and storage, affecting how access to communication systems must be controlled
Federal Information Security Management Act (FISMA): Requires federal agencies to implement information security programs and guidelines for access control measures
Gramm-Leach-Bliley Act (GLBA): Mandates financial institutions to explain their information-sharing practices and protect sensitive data with strict access controls
Health Insurance Portability and Accountability Act (HIPAA): Establishes security standards for protecting medical information, including specific access control requirements for healthcare data
Payment Card Industry Data Security Standard (PCI DSS): Industry standard for organizations handling credit card information, specifying access control requirements for payment data
Sarbanes-Oxley Act (SOX): Requires public companies to establish internal controls and procedures for financial reporting, including IT access controls
Family Educational Rights and Privacy Act (FERPA): Protects the privacy of student education records and specifies access control requirements for educational institutions
State Data Breach Notification Laws: Various state-specific requirements for protecting data and notifying affected parties in case of unauthorized access
California Consumer Privacy Act (CCPA): California's comprehensive privacy law requiring specific access control measures for protecting consumer data
SHIELD Act: New York's Stop Hacks and Improve Electronic Data Security Act requiring robust security measures including access controls
NIST Cybersecurity Framework: Voluntary framework providing guidelines and best practices for managing cybersecurity risks, including access control standards
ISO 27001: International standard for information security management systems, providing comprehensive guidelines for access control
CIS Controls: Prescriptive, prioritized set of actions to improve organizations' cybersecurity posture, including access control measures
FTC Guidelines: Federal Trade Commission's guidelines for businesses on maintaining reasonable data security practices and access controls
FBI Cybersecurity Recommendations: Guidelines and best practices from the Federal Bureau of Investigation for protecting against cyber threats
DHS Cybersecurity Directives: Department of Homeland Security's binding operational directives for federal agencies' cybersecurity practices
General Data Protection Regulation (GDPR): EU regulation with extraterritorial scope affecting US companies handling EU residents' data, including specific access control requirements
