Key Compliance Frameworks
PCI DSS (Payment Card Industry Data Security Standard): applies to organizations that process, store, or transmit credit card data. Twelve requirements including: network segmentation of cardholder data environment (CDE), firewalls required, no default passwords, encrypted transmission, vulnerability scanning and pen testing, access control, logging and monitoring, security policy. Non-compliance risks fines and loss of ability to process payment cards.
HIPAA (Health Insurance Portability and Accountability Act): US federal law protecting Protected Health Information (PHI). Requires: access controls, audit logging, encryption of PHI at rest and in transit, minimum necessary access principle, breach notification within 60 days, business associate agreements. Applies to covered entities (healthcare providers) and business associates (vendors handling PHI).
GDPR (General Data Protection Regulation): EU regulation covering personal data of EU residents. Key requirements: data minimization, purpose limitation, right to erasure ('right to be forgotten'), explicit consent, breach notification within 72 hours, data protection by design. Applies to any organization processing EU resident data, regardless of location.
SOX (Sarbanes-Oxley): US law requiring financial reporting controls for publicly traded companies. IT controls include: access controls to financial systems, audit trails, segregation of duties, change management controls. Network security supports SOX compliance by controlling who can access financial systems.
NIST and Security Frameworks
NIST CSF (Cybersecurity Framework): voluntary framework from the National Institute of Standards and Technology. Five functions: Identify (understand assets and risks), Protect (implement safeguards), Detect (monitor for events), Respond (respond to incidents), Recover (restore capabilities). Widely used as an organizational security maturity model.
NIST SP 800-53: security and privacy controls catalog used by US federal agencies. Comprehensive control families covering access control, audit, incident response, configuration management, and more. Many private organizations adopt SP 800-53 as a rigorous security baseline.
ISO 27001: international standard for Information Security Management Systems (ISMS). Organizations can achieve ISO 27001 certification demonstrating systematic security management. Annex A contains 114 controls across 14 domains.