Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Joe Tech gets a job managing Acme Startup's IT services. Acme Startup handles information of X, Y, and Z data types, and offers services A, B, and C. Joe Tech is aware that some of these data types and/or services may fall under government regulations, but is not sure which. He also knows that Acme Startup's CEO and/or founders aren't likely to be much more knowledgeable on the subject than he is.

Without bringing in a legal team, is there a way Joe Tech can easily determine what laws and/or regulations apply to the data and services Acme Startup handles?

(Note: The particular real-life scenario this relates to is in Florida, U.S.A. but globally-applicable answers - if there can be any - are welcome.)

share|improve this question
    
See similar (but not duplicate) questions: security.stackexchange.com/q/706/33 and security.stackexchange.com/q/2083/33 –  AviD May 23 '11 at 18:46

2 Answers 2

up vote 11 down vote accepted

Core questions you need to ask - and these are covered by some of the answers in the questions @AviD has linked to and at high level by @Beth:

  • Are you handling payment card data? If so, PCI-DSS
  • Are you handling medical info? If so HIPAA in the US, DPA in UK
  • Are you handling personal info? If so DPA in the UK
  • Are you a financial org? GLBA in the US, FSA regs in the UK
  • Do you trade on NYSE? SOX in US, JSOX in Japan - but similar requirements globally
  • Are you a retail bank? BASEL II (soon BASEL III)
  • Are you a European Insurer? Solvency II

There are equivalents for these in many jurisdictions

share|improve this answer
    
Wow, great response! –  Chadddada May 26 '11 at 2:56

Knowing every country your data will be in is a good start. There aren't that many globally enforced laws in this area, so you'll end up wanting to get acquainted with all relevant country laws. The book "Who Controls the Internet?" was a really interesting read on that topic (for me, it was a great audio book).

From there, it's helpful to be able to categorize what type of data you have on your hands. Laws & regulations can generally be categorized into groups based on the industry and the type of data. A good way to start is to first look at what your company's processes are - what's it selling, what's it buying, what types of information has to move around to make that happen. Be sure you keep track of both external data needed to make your products or services happen, and internal data that is typical for any company - like personnel records.

In general (and a lot of coming from Shon Harris' CISSP exam guide - not the best in any single subject, but a good catch all) - there's the following basic types of law:

  • Intellectual property laws - protecting your company's trade secrets, copyrights, trademarks, patents and other intellectual property. Certainly if your company is of any larger size, you already have at least one lawyer on hand who is somewhat versed in this.

  • Privacy law - a collection of laws that protect people, companies, employees and others from the disclosure of information that should not be made public. Everything from personal information, health related information, correct reporting of accounting, protection from hacking and corporate espionage, and employee privacy issues. Some applies to almost every company in the US and some is particular to a given industry or type of information.

  • Prosecution law - not something you generally get into until you have to prosecute, but if you're ardent about it, knowing at least a little about chains of evidence and what has to be done to protect you can help you with establishing recovery procedures that don't cause a corruption in your ability to track down and prosecute someone who's attacked your company.

  • Ethics specific to your particular industry

  • There's also some special areas of law if your company receives federal funds for anything and yet more areas of law if you develop or are involved in anything relating to national security. Those are pretty easy - if you haven't signed any sort of contract with federal, state or local government, these laws are not likely to apply to you.

As far as I know, there's no great online Q&A site where you can answer, say, a series of questions and get information about EVERY law in the US that would apply to your situation. You generally have to take it as it comes and figure out what your data looks like and what laws apply to you. Generally, I'd start with your industry, because you're likely to find other people concerned about the same things you should be worrying about in industry based forums. For example, the defense contractors are birds of a feather - we know almost nothing about health care laws like HIPPA, but we know far too much about the laws surrounding classified systems. :)

share|improve this answer
    
Great response, Beth! –  Chadddada May 26 '11 at 2:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.