SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Compliance Management

cathy avatar
cathy
21 diapositives · 384 Views · Sep 11, 2014

This comprehensive overview explores the critical role of IT policy in compliance management and information assurance. Key concepts include definitions of compliance, the importance of policy in cybersecurity, and how regulatory and standards frameworks shape organizational policies. We discuss major legislation such as HIPAA, GLBA, SOX, and FISMA, emphasizing their impact on security practices. This guide is essential for understanding how to implement effective security policies amid evolving regulations and technology trends.

#compliance management #compliance management ppt #powerpoint #presentation
Compliance Management - slide 1
01 / 21Compliance Management
1 / 17

Télécharger la présentation

Compliance Management
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Compliance Management

  2. Instruction Objectives • Understand the role of IT policy • Define compliance • Identify key security components of IA regulation • Explore the impact of standards on policy

  3. Overview • The role of policy in Information Assurance • Regulatory inputs to organizational policy • Standards inputs to organizational policy

  4. Role of Policy • Policy – the foundation of Cyber Security

  5. Policy Development • Policy is not developed in a vacuum • Various influences • Standards, Guidelines • Law • Organizational goals: Profit, service, etc.

  6. Law and Regulation • Legislative trends • Laws impacting IT: • HIPAA, GLBA, SOX, FISMA • States • Standards: • International • National – NIST

  7. Federal Trends • As technology solutions expand, regulations will grow to protect citizens

  8. HIPAA • Health Insurance Portability and Accountability Act of 1996 • Mandates the development of a healthcare information exchange standard • Requires accountability for the protection of Individually Identifiable Health Information

  9. HIPAA • Standards for Electronic Transactions • Unique Identifiers Standard • Security Rule • Privacy Rule

  10. HIPAA • §164.308 – Administrative safeguards • Security management process: Implement policies and procedures to prevent, detect, contain, and correct security violations • Risk analysis • Risk Management • Sanction Policy • Information systems activity review • Assigned Security Responsibility • Workforce security • Information access management • Security awareness and training • Security reminders • Protection from malicious software • Log-in monitoring • Password management • Security incident procedures • Contingency plan

  11. Graham-Leach-Bliley • Financial Services Modernization Act of 1999 • Updates regulation of the Financial Services industry • TITLE V – Privacy • Mandates publication of Privacy Policy

  12. Sarbanes-Oxley Act • Corporate regulation to ensure accurate publication of financial information • Adds a requirement to audit internal controls • Internal controls = Information Assurance Policies • Formal, auditable policies and practices

  13. FISMA • Federal Information Security Management Act of 2002 • Provides a common security framework for all federal agencies • Decentralized implementation • Generic Federal Template

  14. Generic Federal Template • Mandate electronic interaction • Assign information security responsibility • Assess information security risks • Implement risk-mitigating controls • Train personnel • Report compliance assessment

  15. State Laws • CA 1386 – Mandates disclosure of security breach • Other – Identity Theft, SSNs, Spyware • Resource: National Council of State Legislatures (www.ncsl.org)

  16. Standards • ISO 17799 • Security Policy • System Access Control • Computer and Operations Management • System Development and Maintenance • Physical and Environmental Security • Compliance • Personnel Security • Security Organization • Asset Classification and Control • Business Continuity Management

  17. Standards • NIST – National Institute of Standards and Technology • Publications • ITL Bulletins • FIPS publications • Special publications

  18. Standards Sample • NERC – North American Electricity Reliability Cooperative • Thorough standard for information security policy and compliance • Focuses on Responsibility and Accountability

  19. Standards Sample

  20. Standards Sample

  21. Summary • Legislation tends toward accountability and responsibility. • Many major industries have been required to formalize information security management. • Standards often provide peer-accountability. • These inputs help drive organizational policy.