Assignment 2
Chapter 3



1. Name and Describe two (2) U.S. based compliance laws that exist. 


Federal Information Security Management Act- This act was passed in 2002 as part of the title 3 of the E-Government Act. Its purpose is to ensure that federal agencies protect their data. It gives specific responsibilities for federal agencies. They are responsible for protecting the system and data, complying with all elements of FISMA and integrating security in all processes.

Gramm-Leach Bliley Act also known as the Financial Services Modernization Act of 1999. This act protects your private financial information from being sold to other business. GLBA also offer protection against the practice of obtaining personal information through false pretenses. There are two parts that pertain to IT security which is Financial Privacy Rule which requires companies to notify there customers about there privacy practice and Safeguard rule which means a company must have a security plan in place to protect the consumer information.

Sarbanes-Oxley Act- This act came into law in 2002 to regulate financial practice and corporate governance. This law is intended to hold board members and executives accountable for any financial data that is not accurate. These acts can be punishable by jail time or fines.

2. Discuss the levels of the CMMI process improvement approach.

There are six levels in the CMMI process improvement approach beginning with level 0.

Level 0 is nonexistent. At this level there is no need for security and security controls are not in place.

Level 1 is the initial. This level is referred to as the as needed level.

Level 2 is managed. This level is when the organizations regulate out of feeling instead of having a plan. The organization knows they need security and have risk it’s just not a plan in place.

Level 3 is