Sarbanes-Oxley Act (SOX): Federal law that mandates specific security controls and audit requirements for publicly traded companies, focusing on financial reporting and internal controls
Federal Information Security Management Act (FISMA): Legislative framework that provides security standards and guidelines for federal information systems and their contractors
Health Insurance Portability and Accountability Act (HIPAA): Federal law requiring healthcare organizations to implement security measures to protect patient health information, including specific audit requirements
Gramm-Leach-Bliley Act (GLBA): Federal law requiring financial institutions to implement comprehensive security programs and protect customer data
Payment Card Industry Data Security Standard (PCI DSS): Security standard for organizations that handle credit card data, requiring regular security audits and specific security controls
California Consumer Privacy Act (CCPA): State law providing California residents with data privacy rights and imposing security obligations on businesses handling their data
Virginia Consumer Data Protection Act (VCDPA): State law establishing data privacy and security requirements for businesses operating in Virginia
NIST Cybersecurity Framework: Voluntary framework providing guidelines for private sector organizations to assess and improve their ability to prevent, detect, and respond to cyber attacks
ISO 27001: International standard providing requirements for information security management systems (ISMS) and security controls
CIS Controls: Set of cybersecurity best practices and controls developed by the Center for Internet Security
COBIT Framework: Framework for the governance and management of enterprise IT, including security audit requirements
FedRAMP: Federal program providing standardized security assessment and authorization for cloud services used by government agencies
GDPR: European Union regulation with extraterritorial scope affecting US organizations that handle EU resident data
State Data Breach Notification Laws: Various state-specific requirements for reporting and responding to data breaches, affecting security audit policies
State Cybersecurity Regulations: State-specific cybersecurity requirements and guidelines that may affect security audit procedures and policies
