Security Awareness Compliance Requirements

Like we said on our Getting Approval Page, there are over 8,500 Local, State and Federal standards that your organization might need to comply with. Here is a list of the most common standards and legislations that may require your organizations to have a security awareness program in place. Does your organization accept credit cards? Well, in that case PCI-DSS is in force, and you need to train all staff about data security. (We have a course for that)

1. PCI DSS
§12.6 – Make all employees aware of the importance of cardholder information security.
• Educate employees (for example, through posters, letters, memos, meetings and promotions).
• Require employees to acknowledge in writing that they have read and understood the company’s security policy and procedures. Download the official PCI standard.

Is your company public? You need to have a program in place:

2. Sarbanes-Oxley (SOX)
§404(a).(a).(1) – The Commission shall prescribe rules requiring each annual report required by section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C 78m or 78o(d)) to contain an internal control report which shall – state the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting. If you are planning to go public in the future, start now with a security awareness training project. 

Work in the health care sector? You need to have a program in place:

3. Health Insurance Portability & Accountability Act (HIPAA)
§164.308.(a).(5).(i) – Implement a security awareness and training program for all members of its workforce (including management).

And it goes on…

4. ISO/IEC 27001 & 27002
§ISO 27002 8.2.2 – All employees of the organization and, where relevant, contractors and third party users should receive appropriate awareness training and regular updates in organizational policies and procedures, as relevant for their job function. 

FACTA – FTC Red Flags Rule

Under the FACTA, which amends the Fair Credit Reporting Act, the FTC created the Red Flags Rule. That rule requires training as part of an Identity Theft Prevention Program. See 16 CFR 681.1(d)-(e). Employees should be trained about the various red flags to look out for, and/or any other relevant aspect of the organization’s Identity Theft Prevention Program.

5. Gramm-Leach Bliley Act
§6801.(b).(1)-(3) – In furtherance of the policy in subsection (a) of this section, each agency or authority described in section 6805(a) of this title shall establish appropriate standards for the financial institutions subject to their jurisdiction relating to administrative, technical and physical safeguards –
• To insure the security and confidentiality of customer records and information;
• To protect against any anticipated threats or hazards to the security or integrity of such records;
• To protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer. 

6. CobiT
§PO7.4 Personnel Training – Provide IT employees with appropriate orientation when hired and ongoing training to maintain their knowledge, skills, abilities, internal controls and security awareness at the level required to achieve organizational goals. §DS7 – Management of the process of Educate and train users that satisfies the business requirement for IT of effectively and efficiently using applications and technology solutions
and ensuring user compliance with policies and procedures is: […] 3 Defined when a training and education program is instituted and communicated, and employees and managers identify and document training needs. Training and education processes are standardized and documented. Budgets, resources, facilities and trainers are being
established to support the training and education program. Formal classes are given to employees on ethical conduct and system security awareness and practices. Most training and education processes are monitored, but not all deviations are likely to be detected by management. Analysis of training and education problems is only occasionally applied.

7. Federal Information Security Management Act (FISMA) 
§3544.(b).(4).(A),(B) – Securing awareness training to inform personnel, including contractors and other users of information systems that support the operations and assets of the agency, of information security risks associated with their activities; and their responsibilities in complying with agency policies and procedures designed to reduce these risks.

8. NERC CIP
The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection Standard. §CIP-004-3(B)(R1) – The Responsible Entity shall establish, document, implement, and maintain a security awareness program to ensure personnel having authorized cyber or authorized unescorted physical access to Critical Cyber Assets receive on-going reinforcement in sound security practices. The program shall include security awareness reinforcement on at least a quarterly basis using mechanisms such as:
• Direct communications (e.g., emails, memos, computer based training, etc.);
• Indirect communications (e.g., posters, intranet, brochures, etc.);
• Management support and reinforcement (e.g., presentations, meetings, etc.).

9. US State Privacy Laws
Many states in the United States have their own individual privacy laws. Here are a few examples:

• Texas Health Privacy Law
  Texas’s Health Privacy Law, H.B. No. 300 § 181.101, requires employees to be trained about both the state’s law and HIPAA. This is one of the few state health laws that mandates training about Texas’s own health privacy law. Additionally, it requires training about HIPAA. Penalties for violating the Texas law are quite high, equivalent to HIPAA.
  
  
• Massachusetts Data Security Law
  It’s called 201 CMR 17.03, mandates training to maintain a comprehensive information security program. The training should focus on reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper, or other records containing personal information. Training must be “ongoing” and must be given for not only permanent employees but also temporary and contract employees.
  
  You can find a listing of most of those state privacy laws at the Morrison & Foerster’s Privacy Library. Many of these privacy laws require some type of awareness training, or at a minimum that the privacy requirements are communicated to employees in that state. 
  
  
• Federal Guidelines for the Sentencing of Organizations
  You might want to have a look at The Federal Guidelines for the Sentencing of Organizations. This is not regulation per se, but something that affects how your organization will be treated when there is a breach (under federal law). §8C2.5 of the Guidelines define an organizational culpability score [for the misdeeds of employees and officers]. Culpability is inversely related to the organization implementing an ‘effective compliance and ethics program’. §8B2. defines an effective compliance and ethics program to include a training program in the organizations standards and procedures. So in Federal Court, the organization is culpable in its workforce’s misuse of corporate information assets to the degree that the organization does not train employees with respect to appropriate conduct. It is likely that non-federal jurisdictions will apply something very similar to the Federal Guidelines.
  
  
• SEC Cybersecurity Examination Initiative Guidance 
  Training: Information with respect to training provided by the firm to its employees regarding information security and risks, including the training method (e.g., in person, computer based learning, or email alerts); dates, topics, and groups of participating employees; and any written guidance or materials provided.

Related Pages: Security Awareness Training