(upbeat music)
- [Lisa] An organization must incorporate safeguards into
the security compliance plan to defend against attacks.
Over the years, standards, regulations, and guidelines,
such as PCI DSS, HIPAA, SOX, and GDPR
have reduced the amount of data exposure.
The standards, regulations, and guidelines
are important to understand
as they outline the way an organization
should implement appropriate security measures
to address and reduce overall risk.
Payment Card Industry Data Security Standard or PCI DSS,
is a set of widely accepted requirements
to secure credit card transactions.
PCI DSS is not a law or government regulation.
It's an industry standard developed
by the payment card industry.
If you do any credit card transactions, you must comply,
otherwise the company will face hefty fines
and may lose the ability to handle credit card transactions.
The Health Insurance Portability and Accountability Act,
or HIPAA, is also called the Privacy Rule.
Now this is legislation that governs data privacy
and security practices that safeguard
all patient electronic Protected Health Information,
or ePHI, in US medical facilities,
along with reporting any breach activity.
Anyone who is in violation of the policies and procedures
will face penalties.
Sarbanes-Oxley, or SOX,
is a set of compliance requirements outlined
for public companies.
SOX specifies methods to create
and sustain security controls, and procedures,
and conduct a yearly audit to reduce corporate fraud
and protect investors.
US lawmakers created the 2002 Sarbanes Oxley Act or SOX,
in response to several corporate accounting scandals
occurring between the years of 2000 and 2002.
Let's take a look.
Now here we see that
the 10 worst corporate accounting scandals of all times.
Here we see waste management reported $1.7 billion
in fake earnings.
Here we see WorldCom inflated assets
by as much as $11 billion.
And in 2002, Tyco CEO stole 150 million
and then also inflated company income by 500 million.
Now although all scandals were significant,
in the early 2000s,
Enron, a large financially sound Texas-based company,
committed several different crimes
along with fraudulent reporting
that were extensive and ongoing.
Shareholders eventually lost $74 billion.
The Enron scandal pushed the American public and Congress
to recognize the need for new compliance standards
for public accounting and auditing.
Although SOX has many sections,
sections 301 and 404 indirectly deal
with information assurance and data integrity.
All companies must monitor and manage all data
and financial transactions,
and provide an annual report on what internal controls
are in place,
along with the effectiveness of the controls.
Financial reports must be accurate and complete,
with no evidence of unauthorized transactions
or data manipulation.
GDPR, or the General Data Protection Regulation
is a comprehensive data privacy law
that gives consumers control of their data.
GDPR affects companies located in and outside
the European Union, and companies can face up to 4%
of total global turnover if they breach the rules.
There are many standards and regulations
that provide guidelines so that companies do their due care
and due diligence to ensure data privacy and security.
(upbeat music)