Understanding various regulations is crucial for CISSP certification, particularly within the Security and Risk Management domain. These regulations provide guidelines and legal requirements for protecting information and ensuring privacy. Below is a summary of key regulations that CISSP candidates should be familiar with:

Key Regulations

1. General Data Protection Regulation (GDPR)
   • Region: European Union
   • Purpose: Protects personal data and privacy of individuals within the EU and EEA.
   • Key Elements: Data subject rights, consent requirements, data protection principles, penalties for non-compliance.
   • Impact: Organizations must implement strict data protection measures and ensure the rights of data subjects are upheld.
2. Health Insurance Portability and Accountability Act (HIPAA)
   • Region: United States
   • Purpose: Protects the privacy and security of health information.
   • Key Elements: Privacy Rule, Security Rule, Breach Notification Rule.
   • Impact: Healthcare providers must ensure the confidentiality, integrity, and availability of electronic protected health information (ePHI).
3. Sarbanes-Oxley Act (SOX)
   • Region: United States
   • Purpose: Protects investors by improving the accuracy and reliability of corporate disclosures.
   • Key Elements: Internal controls, audit requirements, corporate responsibility.
   • Impact: Public companies must establish and maintain effective internal controls for financial reporting.
4. Payment Card Industry Data Security Standard (PCI-DSS)
   • Region: Global
   • Purpose: Protects cardholder data.
   • Key Elements: Data encryption, access controls, regular monitoring and testing.
   • Impact: Any organization that processes, stores, or transmits credit card information must comply with PCI-DSS requirements.
5. Federal Information Security Management Act (FISMA)
   • Region: United States
   • Purpose: Ensures the security of federal information systems.
   • Key Elements: Risk management, continuous monitoring, security controls.
   • Impact: Federal agencies must implement comprehensive information security programs.
6. Children’s Online Privacy Protection Act (COPPA)
   • Region: United States
   • Purpose: Protects the privacy of children under 13 years old online.
   • Key Elements: Parental consent, data collection restrictions, privacy policies.
   • Impact: Websites and online services directed at children must comply with COPPA requirements.
7. Gramm-Leach-Bliley Act (GLBA)
   • Region: United States
   • Purpose: Protects consumer financial information.
   • Key Elements: Financial Privacy Rule, Safeguards Rule, pretexting protection.
   • Impact: Financial institutions must implement measures to protect sensitive customer data.
8. California Consumer Privacy Act (CCPA)
   • Region: United States (California)
   • Purpose: Enhances privacy rights and consumer protection for residents of California.
   • Key Elements: Data access rights, opt-out rights, data deletion rights.
   • Impact: Businesses that collect personal information of California residents must comply with CCPA requirements.