Computer Fraud and Abuse Act (CFAA): Federal law that prohibits accessing a computer without authorization, or in excess of authorization. Must be considered in access management policies to prevent unauthorized access and define proper authorization levels.
Electronic Communications Privacy Act (ECPA): Federal law governing the interception and monitoring of electronic communications. Relevant for access management policies regarding email monitoring and electronic communication systems.
Federal Information Security Management Act (FISMA): Requires federal agencies and their contractors to develop and implement information security programs. Sets standards for access controls and security measures.
Sarbanes-Oxley Act (SOX): Applicable to publicly traded companies, requires strict internal controls for financial reporting systems, including access controls and audit trails.
Health Insurance Portability and Accountability Act (HIPAA): Mandates security measures for protecting healthcare data, including strict access controls and audit requirements for healthcare information systems.
Gramm-Leach-Bliley Act (GLBA): Requires financial institutions to implement comprehensive security programs, including access controls to protect customer financial information.
Payment Card Industry Data Security Standard (PCI DSS): Industry standard for organizations handling credit card information, requiring specific access control measures and user authentication requirements.
Family Educational Rights and Privacy Act (FERPA): Federal law protecting student education records, requiring specific access controls and permissions for educational institutions.
Defense Federal Acquisition Regulation Supplement (DFARS): Cybersecurity requirements for defense contractors, including specific access control and security measures for protecting controlled unclassified information.
State Data Breach Notification Laws: Various state-specific requirements for reporting unauthorized access to personal information, affecting how access violations must be monitored and reported.
California Consumer Privacy Act (CCPA): California-specific privacy law requiring businesses to implement specific access controls and data protection measures for California residents' personal information.
SHIELD Act: New York state law requiring businesses to implement safeguards for protecting private information, including access control requirements and security measures.
General Data Protection Regulation (GDPR): EU privacy law affecting organizations handling EU residents' data, requiring strict access controls, user consent management, and data protection measures.
NIST Cybersecurity Framework: Voluntary framework providing guidelines for access management and cybersecurity controls, widely adopted as a best practice standard.
ISO 27001: International standard for information security management systems, providing requirements for establishing, implementing, and maintaining security controls including access management.
CIS Controls: Set of best practice guidelines for cyber defense, including specific recommendations for access control and account management.
