Computer Fraud and Abuse Act (CFAA): Federal law that provides legal framework for protecting computer systems from unauthorized access, fraud, and related activities
Federal Information Security Management Act (FISMA): Federal law requiring federal agencies to implement information security programs and protect government data
Electronic Communications Privacy Act (ECPA): Federal law extending government restrictions on wire taps to include transmitted and stored electronic data
Cybersecurity Information Sharing Act (CISA): Federal law designed to improve cybersecurity through enhanced sharing of information about security threats
Health Insurance Portability and Accountability Act (HIPAA): Federal law establishing standards for protecting sensitive patient health information from disclosure without consent
Gramm-Leach-Bliley Act (GLBA): Federal law requiring financial institutions to explain their information-sharing practices and protect sensitive data
Family Educational Rights and Privacy Act (FERPA): Federal law protecting the privacy of student education records
NIST Special Publication 800-53: Security and privacy controls standard for federal information systems and organizations
NIST Cybersecurity Framework: Voluntary guidance for private sector organizations to better manage and reduce cybersecurity risk
Sarbanes-Oxley Act (SOX): Federal law establishing requirements for IT controls and data security in financial reporting
State Data Breach Notification Laws: Various state-specific laws requiring organizations to notify individuals of security breaches involving personally identifiable information
California Consumer Privacy Act (CCPA): California state law providing residents with data privacy rights and control over their personal information
NIST Digital Identity Guidelines (SP 800-63): Technical requirements for federal agencies implementing digital identity services
OAuth 2.0 and OpenID Connect Standards: Industry standards for authorization and authentication protocols in identity management
General Data Protection Regulation (GDPR): EU regulation on data protection and privacy affecting organizations handling EU residents' data
Identity Theft and Assumption Deterrence Act: Federal law that makes identity theft a federal crime and provides penalties for such offenses
Identity Theft Red Flags Rule: Federal regulation requiring businesses to implement identity theft prevention programs
