Computer Fraud and Abuse Act (CFAA): Federal law that prohibits accessing a computer without authorization, or in excess of authorization. Key consideration for access control policies.
Electronic Communications Privacy Act (ECPA): Federal law governing the interception of electronic communications and access to stored electronic communications.
Health Insurance Portability and Accountability Act (HIPAA): Federal law that requires protection of sensitive patient health information, including specific access control requirements for healthcare data.
Gramm-Leach-Bliley Act (GLBA): Federal law requiring financial institutions to explain their information-sharing practices and protect sensitive data.
Federal Information Security Management Act (FISMA): Federal law defining framework for protecting government information, systems and assets against natural or man-made threats.
Sarbanes-Oxley Act (SOX): Federal law requiring public companies to establish internal controls and procedures for financial reporting, including IT controls.
Payment Card Industry Data Security Standard (PCI DSS): Industry security standard for organizations that handle credit card information, including specific access control requirements.
Family Educational Rights and Privacy Act (FERPA): Federal law that protects the privacy of student education records and specifies access control requirements for educational institutions.
State Data Breach Notification Laws: Various state-specific laws requiring organizations to notify individuals of security breaches involving personally identifiable information.
California Consumer Privacy Act (CCPA): California state law providing consumers with rights regarding their personal information and imposing obligations on businesses.
SHIELD Act: New York state law requiring businesses to implement safeguards for the protection of private information of New York residents.
NIST Cybersecurity Framework: Voluntary guidance, based on existing standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk.
ISO 27001: International standard providing requirements for an information security management system (ISMS), including access control specifications.
CIS Controls: Set of prioritized best practices for securing IT systems and data, including specific guidelines for access control.
General Data Protection Regulation (GDPR): EU regulation that may apply when handling EU residents' data, including strict requirements for data access and control.
