Business of IT Understanding Regulatory Compliance
In the last few years, governments the world over have taken up the job of protecting consumers and companies against poor management of sensitive information. Unfortunately, this has led to a steady stream of confusing laws and regulations coming from all directions. In this column I'll look at these laws, go into depth on a few of them, and discuss how you, as an IT pro charged with making your company compliant, can approach the issue.
Laws and Regulations
Depending on the industry you're in, your organization may be used to regulations or completely new to them. Late 90s and early 2000s ushered in the era of laws governing information security, privacy, and accountability, thanks to companies like Enron and to the sheer volume of personal and sensitive information stored in and transmitted though vulnerable channels.
At the root of most regulations is the importance of protecting the confidentiality, integrity, and availability of information that impacts a corporation and its stakeholders. These laws can be distilled down to their essential goals: Establish and implement controls
Maintain, protect, and assess compliance issues
Identify and remediate vulnerabilities and deviations
Provide reporting that can prove your organization's compliance
Taking a look at the laws and regulations having immediate impact on IT pros, to understand what each law is about. Don't assume this list represents all of the laws and regulations that may apply to your business. There are many others both in the United States and globally you may or may not need to deal with, depending on your organizations situation.
New Laws and Regulations Affecting IT Pros
Sarbanes-Oxley the Sarbanes-Oxley Act of 2002 (SOX) was a response to corporate scandals, thank you Enron! Most prominent aspect, from an IT view point, requires that