GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and …

Statement

Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

Guidance

Determine a process to track and manage legal and regulatory requirements regarding protection of individuals' information (e.g., Health Insurance Portability and Accountability Act, California Consumer Privacy Act, General Data Protection Regulation)

Guidance

Determine a process to track and manage contractual requirements for cybersecurity management of supplier, customer, and partner information

Guidance

Align the organization's cybersecurity strategy with legal, regulatory, and contractual requirements

1. Forbhreathnú

1.1 Tagairtí

• 1.1 Policy on the security of network and information systems
• 5.1 Supply chain security policy
• 13.1 Supporting utilities

1.2 Ceanglais aitheanta

1.3 Rialacháin ghaolmhara

2. Ceanglais aitheanta

3. Rialacháin ghaolmhara

Saincheisteanna nasctha

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final