Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There's a few very popular regulations, HIPAA, SOX, PCI-DSS, PII, ITAR, GLBA.

Can anyone explain what are their exact security implications? Exactly what type of implementations would my organization has to do in order to be compliant?

In this question, I don't care about keeping data preserved (backups, etc), just interested in the security side of things.

Are these regulations requiring firewalls? pen-tests? encryption? all of the above? something else?

A summary would be very informative. It would take a long time for me to read the details and get the specifics on my own.

share|improve this question

closed as not a real question by Chris Dale, Scott Pack, Rory Alsop Jul 13 '12 at 9:27

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

It looks like a very broad question and require a very big answer in order to list all security implications for all these regulations and standards – Chris Dale Jul 12 '12 at 10:50
Just so we're 100% clear, Roy, you work for a US publicly traded company operating simultaneously as a bank, arms dealer, and healthcare provider, but you don't have a corporate governance team telling you what your regulatory requirements are? – Graham Hill Jul 12 '12 at 12:51
@GrahamHill: As much as I'm in love with the snarkiness of your comment, with the exception of SOX that list of regulations apply to most every university of medium size or larger. – Scott Pack Jul 12 '12 at 14:04
I'm just trying to get the bottom line from each regulation, a 1-liner like "Firewall or pentesting each year and data encryption" - I tried reading the regulations themselves, but they are way too bloated. I thought an expert in the field would be able to sum it up. – Roy Reznik Jul 12 '12 at 14:05
@RoyReznik: Unfortunately, each regulation is also too complex for us to sum them up in a such a fashion without being professionally negligent. – Scott Pack Jul 12 '12 at 14:29

Browse other questions tagged or ask your own question.