Computer Fraud and Abuse Act (CFAA): Federal law that addresses unauthorized access and computer system security. Must be considered when defining acceptable use and system access policies.
Electronic Communications Privacy Act (ECPA): Federal legislation governing the monitoring and privacy of electronic communications. Essential for defining email and communication monitoring policies.
Stored Communications Act (SCA): Federal law protecting stored electronic communications. Important for policies regarding data storage and access to stored communications.
Health Insurance Portability and Accountability Act (HIPAA): Federal law protecting medical information. Must be considered if the organization handles healthcare data or employee medical information.
Children's Online Privacy Protection Act (COPPA): Federal law protecting online privacy of children under 13. Relevant if the organization's ICT services might be used by or accessible to children.
Federal Information Security Management Act (FISMA): Federal law establishing information security standards for federal information systems. Applicable if dealing with government information or systems.
State Data Breach Notification Laws: State-specific laws requiring notification of affected parties in case of data breaches. Varies by state and must be incorporated into incident response policies.
California Consumer Privacy Act (CCPA): California's comprehensive privacy law that may affect organizations doing business in California or handling California residents' data.
National Labor Relations Act (NLRA): Federal law protecting employee rights including communication. Must be considered when defining social media and communication policies.
Americans with Disabilities Act (ADA): Federal law requiring accessibility accommodations. Relevant for ensuring ICT systems and policies account for users with disabilities.
Payment Card Industry Data Security Standard (PCI DSS): Industry standard for organizations handling credit card data. Must be incorporated if the organization processes payment card information.
Gramm-Leach-Bliley Act (GLBA): Federal law governing privacy and security requirements for financial institutions. Relevant if operating in financial services sector.
State Cybersecurity Laws: State-specific cybersecurity regulations, such as New York's SHIELD Act, requiring specific security measures and protections for personal data.
