[MUSIC PLAYING]
Before we go further, we need to cover
a topic we call compliance.
Now, we talked before, in cybersecurity basics,
about business needs.
Depending on the size of your company, the organization,
will really shape what cybersecurity looks
like for that organization.
A lot comes down to risk management.
And sometimes, a company might think, you know what?
We're going to accept the risk.
Sometimes, they're not allowed to.
There are these things, regulations, put out
by some companies, and some others
by governments, that say you must
put these things into place.
Otherwise, you could be fined and lose the ability
to operate in certain regions.
The PCI DSS or payment card industry data security
standard, it was mandated by card brands--
Mastercard, American Express, Visa, JCB, and Discover.
They all got together and said, look, we're
doing all of this e-commerce.
If people are going to use our cards on the internet,
then they need to comply by these certain standards.
They're administered by the Payment Card Industry Security
Standards Council, which is a conglomerate put together
by all of these companies.
And it's created increased controls around cardholder data
to reduce credit card fraud.
They got tired of having to deal with all this fraud.
And so they said, look, if you're
going to take credit cards on your website,
you have to comply.
And rather than us having to deal with fraud, if you fail
to properly secure customer information,
then we're going to fine you.
Put the impetus back on companies
to say, look, the same way that if you take their cash,
you want to secure it, you've got to secure their information
as well.
And that, in turn, actually makes the whole society
a lot safer in general.
The next one covers HIPAA, the Health Insurance Portability
and Accountability Act of 1996.
It's a lot easier just say HIPAA.
The US government came up with this regulation
for use and disclosure of protected health information.
Back then, in 1996, the internet wasn't what it is now.
But at the same time, the law included a bunch
of security requirements for people's health care
information.
The final rule in security standards was issued in 2003,
and that really shaped a lot of their standards
and specifications for administrative safeguards,
physical safeguards, and technical safeguards.
So that can be policies, locks, and software
required when dealing with people's health care
information.
And the act goes into what all that includes
and what all that means.
But it's another regulation out there
that if someone is dealing with health care information for US
citizens or under the US government purview, then
they have to comply.
Another recent law, GDPR, the General Data Protection
Regulation.
It's a data protection and privacy
law in the European Union and European Economic Area.
And controllers and processors of personal data
must put in place appropriate technical and organizational
measures to implement data protection principles.
The EU got tired of people not caring about their customers'
or other peoples' data and said, look,
you will put things in place.
You will protect it properly.
Otherwise, we will fine you or you will not
be able to operate in the EU or the European Economic Area.
This now applies globally, because anyone
who does any sort of Commerce in the EU
also is affected by this.
Similarly, California put out the California Consumer Privacy
Act, CCPA.
It's intended to enhance privacy rights and consumer protection
for residents of California.
It's a big state, larger than some countries.
So it makes sense that they would
put in place rules and regulations
to support its citizens.
Companies that become victims of data theft or other data
security breaches can be ordered in civil class-action lawsuits
to pay statutory damages.
That hasn't been seen yet, but it puts an impetus on companies
that they really need to secure information.
Otherwise, they could be under legal class action
by Californians.
And that's not something you ever want for a company.
There's also liability that could apply in respect
to businesses in overseas countries
who ship items to California.
So it's taken one group of people
and, now, applied their security to, possibly,
any company that is shipping things to California.
Next, we have SOX, the Sarbanes-Oxley act of 2002.
Now, this is generally not a cybersecurity act,
but it does include some cybersecurity features.
There's a US federal law that mandates certain practices
in financial record keeping and reporting for corporations.
This grew out of fudging the numbers
and getting caught by the IRS and the FBI,
and put in place a lot of restrictions and fines
on CEOs and CFOs who don't properly handle financial data
for their organizations.
But it also includes the requirement
for internal control processes over IT infrastructure
and applications that house financial information that
flows into financial reports in order
to enable them to make timely disclosures to the public
if a breach were to occur.
If your financial data is held by an organization
and they're breached, they're now
going to be looked at by other federal organizations
and held liable for not properly securing your financial data.
That's helpful.
So there's all these regulations.
There was business needs.
Now there's regulations and compliance.
And if people want to operate companies in these regions
or in these--
let's call them verticals--
health care, finance, then they need
to comply with the laws and regulations set forth.
We'll get into how do they actually
do that in this next part.