State of the Practice of Computer Security Incident Response Teams ...

Federal Trade Commission
16 CFR Part 314 – Standards for Safeguarding Customer Information
http://www.ftc.gov/os/2002/05/67fr36585.pdf
Implements sections of the Gramm-Leach-Bliley Act and “sets forth standards for developing,
implementing, and maintaining reasonable administrative, technical, and physical safeguards
to protect the security, confidentiality, and integrity of customer information.” Financial
institutions must implement an information security program.
Other Lists of U.S. IT Laws
Chief Information Officers Council (CIOC) Documents – IT Related Laws and Legislation
http://cio.gov/index.cfm?function=documents&section=it related laws and regulations
FedCIRC – Library – Legislation
http://www.fedcirc.gov/library/legislation/
GSA Office of Electronic Government and Strategy – http://www.estrategy.gov/
E-Government Laws, Regulations, and Policies
http://www.estrategy.gov/it_policy_documents.cfm
Key E-Government Related Laws – http://www.estrategy.gov/elaws.cfm
All E-Government Related Laws Chronological By Congress –
http://www.estrategy.gov/lawscongress.cfm
GSA – Policies, Guidelines, Regulations, and Best Practices
http://www.gsa.gov/Portal/policies.jsp
NIST – CSRC – Policies – Federal Requirements
http://csrc.nist.gov/policies/
U.S. Department of Education – Office of the Chief Information Officer – Legislation and
Guidelines
http://www.ed.gov/print/about/offices/list/ocio/legislation.html
Other U.S. Industry Standards
American Institute of Certified Public Accountants (AICPA) – http://www.aicpa.org/
Statement on Auditing Standards (SAS) No. 70, Service Organizations
Audit guide for reports on a service organization’s controls, and for financial statements of
entities that use service organizations
http://www.sas70.com/
United States State Laws
National Security Institute – Computer Crime Laws by State
http://nsi.org/Library/Compsec/computerlaw/statelaws.html
CMU/SEI-2003-TR-001 175