Appendix D - Primary Security and Privacy Mandates.pdf

Page 1 of 6 APPENDIX D

NYS Office of Information Technology Services

PRIMARY SECURITY AND PRIVACY MANDATES

Significant federal and state laws, regulations, policies, standards, and guidelines

• Criminal Justice Information Services (CJIS) Security Policy

• Federal Educational Rights and Privacy Act (FERPA)

• Federal Information Security Management Act (FISMA)

- National Institute of Technology Standards

• Gramm-Leach-Bliley Act (GLB) Act

• Health Insurance Portability and Accountability Act (HIPAA)

• Health Information Technology for Economic and Clinical Health Act (HITECH)

• IRS Publication 1075

• Payment Card Industry Data Security Standard (PCI DSS)

• Sarbanes-Oxley Act (SOX)

• Electronic Communications Privacy Act, Stored Communications Act and the

PATRIOT Act

• New York State Breach Notification Act http://www.dhses.ny.gov/ocs/breach-notification/

• NYS Cyber Security Policy and related Standards https://its.ny.gov/ciso/policies/security

• NYS Cyber Incident Reporting http://www.its.ny.gov/incident-reporting

Criminal Justice Information Services (CJIS) Security Policy

The CJIS Security Policy represents a shared responsibility between the Federal Bureau of Investigations (FBI) and CJIS System Agencies (CSA) and State Identification Bureau (SIB).

For the state of New York, the NY State Police is the CSA, and the Department of criminal justice is the SIB. The policy covers the roles and responsibilities for the FBI and the CSA and service providers covered under a CJIS security addendums and CJSI management control agreements.

CJIS requirements guidance:

- http://www.fbi.gov/about-us/cjis/cjis-security-policy-resource-center/view

Federal Educational Rights and Privacy Act (FERPA) - State Ed, Higher Ed

Protects the privacy of student education records. “Education records” are “those records, files documents, and other materials which 1) contain information directly related to a student; and

2) are maintained by an educational institution. Examples: Grades, courses taken, schedule, test scores, advising records, educational services received, disciplinary actions, student identification number, Social Security number, student private email.

FERPA applies to all schools that receive funds under an applicable program of the U.S.

Department of Education.

FERPA requirements guidance:

- http://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html

- Electronic Code of Federal Regulations, Title 34, Part 99

Federal Information Security Management Act of 2002 (FISMA)

FISMA requires each federal agency to develop, document, and implement an effective agency-wide program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or http://www.dhses.ny.gov/ocs/breach-notification/ http://www.dhses.ny.gov/ocs/breach-notification/ https://its.ny.gov/ciso/policies/security http://www.its.ny.gov/incident-reporting http://www.fbi.gov/about-us/cjis/cjis-security-policy-resource-center/view http://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html statements and impersonation. Page 3 of 6 managed by another agency, contractor, or other source. It is Title III of the E-Government Act of 2002. It affects Federal agencies, and other agencies they share data with.

Key requirements/provisions include:

• Periodic risk assessments.

• Policies and procedures based on these assessments that cost-effectively reduce information security risk and ensure security is addressed throughout the life cycle of each information system.

• Subordinate plans for information security for networks, facilities, etc.

• Security awareness training for personnel.

• Periodic testing and evaluation of the effectiveness of information security policies, procedures, practices and controls, at least on an annual basis.

• A process to address deficiencies in information security policies.

• Procedures for detecting, reporting and responding to security incidents.

• Procedures and plans to ensure continuity of operations for information systems that support the organization's operations and assets.

FISMA requirements guidance:

- http://csrc.nist.gov/drivers/documents/FISMA-final.pdf

- http://www.dhs.gov/federal-information-security-management-act-fisma

- http://csrc.nist.gov/groups/SMA/fisma/overview.html

- http://csrc.nist.gov/groups/SMA/fisma/

FISMA requires that federal agencies comply Federal Information Processing Standards (FIPS) developed by the National Institute of Standards and Technology (NIST). Guidance documents and recommendations are issued in the NIST Special Publication (SP) 800-series.

Office of Management and Budget (OMB) policy OMB Memorandum M-10-15, directs agencies to follow NIST guidance.

NIST Special Publications http://csrc.nist.gov/publications/PubsSPs.html

Gramm-Leach-Bliley Act (GLB) Act of 1999

The GLB Act (also known as the Financial Modernization Act of 1999), includes provisions to protect consumers' personal financial information held by financial institutions. There are three principal parts to the privacy requirements: the Financial Privacy Rule, the Safeguards Rule and pretexting provisions.

GLB affects financial institutions (banks, securities firms, insurance companies), as well as companies providing financial products and services to consumers (including lending, brokering or servicing any type of consumer loan; transferring or safeguarding money;

preparing individual tax returns; providing financial advice or credit counseling; providing residential real estate settlement services; collecting consumer debts).

Key requirements/provisions: The privacy requirements of GLB include three principal parts:

• The Financial Privacy Rule: Requires financial institutions to give customers privacy notices that explain its information collection and sharing practices. In turn, customers have the right to limit some sharing of their information. Financial institutions and other companies that receive personal financial information from a financial institution may be limited in their ability to use that information.

• The Safeguards Rule: Requires all financial institutions to design, implement and maintain safeguards to protect the confidentiality and integrity of personal consumer information.

• Pretexting provisions: Protect consumers from individuals and companies that obtain http://csrc.nist.gov/drivers/documents/FISMA-final.pdf http://www.dhs.gov/federal-information-security-management-act-fisma http://csrc.nist.gov/groups/SMA/fisma/overview.html http://csrc.nist.gov/groups/SMA/fisma/ http://csrc.nist.gov/publications/PubsSPs.html statements and impersonation. Page 3 of 6 their personal financial information under false pretenses, including fraudulent

GLB requirements guidance:

• http://www.business.ftc.gov/privacy-and-security/gramm-leach-bliley-act

Health Information Portability Accountability Act (HIPAA)

HIPAA has two major arms: Privacy and Security. Privacy tends to be a business (non-IT) focus, involving the program, HIPAA Privacy Officer and legal. Security tends to be more IT-focused (though it does cover handling of paper records as well).

Many health agencies have compliance requirements that are more stringent than HIPAA - HIPAA is the baseline. For example, NYS Public Health law has tight requirements regarding AIDS information. The Federal 42 CFR Part 2 guides privacy requirements of substance abuse information. NYS Mental Hygiene law extends HIPAA consent requirements.

Accordingly, meeting baseline HIPAA requirements may not be sufficient in all cases.

HHS (Federal Health and Human Services) HIPAA resources and requirements:

• Privacy rule: http://www.hhs.gov/ocr/privacy/hipaa/administrative/privacyrule/index.html

• Security rule:

http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/index.html

Summarized versions:

• http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html

• http://www.hhs.gov/ocr/privacy/hipaa/understanding/srsummary.html

HHS Educational Series bulletins:

• http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/securityruleguidance.h tml

• https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/securityrule/sec urity101.pdf?language=es

• highlights what is required and what is addressable.

Health Information Technology for Economic and Clinical Health (HITECH) Ac t

The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted in 2009, promotes the adoption and meaningful use of health information technology. Subtitle D of the HITECH Act addresses the privacy and security concerns associated with the electronic transmission of health information, in part, through several provisions that strengthen the civil and criminal enforcement of the HIPAA rules.

HITECH requirements guidance:

- http://www.hhs.gov/ocr/privacy/hipaa/administrative/enforcementrule/hitechenforcemen tifr.html

IRS Safeguard Program, Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies and Entities Pub1075 contains specific requirements for safeguarding federal tax information (current revision effective on Jan. 1, 2014).

- http://www.irs.gov/uac/Safeguards-Program

- www.irs.gov/pub/irs-pdf/p1075.pdf

Payment Card Industry Data Security Standard (PCI DSS) http://www.business.ftc.gov/privacy-and-security/gramm-leach-bliley-act http://www.hhs.gov/ocr/privacy/hipaa/administrative/privacyrule/index.html http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/index.html http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html http://www.hhs.gov/ocr/privacy/hipaa/understanding/srsummary.html http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/securityruleguidance.html http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/securityruleguidance.html https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/securityrule/security101.pdf?language=es https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/securityrule/security101.pdf?language=es http://www.hhs.gov/ocr/privacy/hipaa/administrative/enforcementrule/hitechenforcementifr.html http://www.hhs.gov/ocr/privacy/hipaa/administrative/enforcementrule/hitechenforcementifr.html http://www.irs.gov/uac/Safeguards-Program http://www.irs.gov/pub/irs-pdf/p1075.pdf

The PCI DSS is a set of requirements for enhancing security of payment customer account Page 4 of 6 data, developed by the founders of the PCI Security Standards Council, including American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa to help facilitate global adoption of consistent data security measures. PCI DSS includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures. The Council also issued requirements called the Payment Application Data Security Standard (PA DSS) and PCI Pin Transaction Security (PCI PTS). PCI affects retailers, credit card companies, anyone handling credit card data. Currently, PCI DSS specifies 12 requirements, organized in six basic objectives:

Objective 1: Build and Maintain a Secure Retail Point of Sale System.

- Requirement 1: Install and maintain a firewall configuration to protect cardholder data

- Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

Objective 2: Protect Cardholder Data

- Requirement 3: Protect stored cardholder data

- Requirement 4: Encrypt transmission of cardholder data across open, public networks

Objective 3: Maintain a Vulnerability Management Program

- Requirement 5: Use and regularly update anti-virus software

- Requirement 6: Develop and maintain secure systems and applications

Objective 4: Implement Strong Access Control Measures

- Requirement 7: Restrict access to cardholder data by business need-to-know

- Requirement 8: Assign a unique ID to each person with computer access

- Requirement 9: Restrict physical access to cardholder data

Objective 5: Regularly Monitor and Test Networks

- Requirement 10: Track and monitor all access to network resources and cardholder data

- Requirement 11: Regularly test security systems and processes

Objective 6: Maintain an Information Security Policy

- Requirement 12: Maintain a policy that addresses information security

PCI compliance requirements:

• PCI DSS https://www.pcisecuritystandards.org/security_standards/documents.php

• PA DSS

https://www.pcisecuritystandards.org/security_standards/documents.php?agreements=pcid ss&associatio n=pcidss

• PCI PTS https://www.pcisecuritystandards.org/security_standards/documents.php

Sarbanes-Oxley Act of 2002 (SOX)

The Sarbanes-Oxley Act is designed to protect investors and the public by increasing the accuracy and reliability of corporate disclosures. It was enacted after the high-profile Enron and WorldCom financial scandals of the early 2000s. It is administered by the Securities and Exchange Commission, which publishes SOX rules and requirements defining audit requirements and the records businesses should store and for how long. It affects U.S. public company boards, management and public accounting firms.

The Act is organized into 11 titles:

1. Public Company Accounting Oversight https://www.pcisecuritystandards.org/security_standards/documents.php https://www.pcisecuritystandards.org/security_standards/documents.php?agreements=pcidss&amp%3Bassociation=pcidss https://www.pcisecuritystandards.org/security_standards/documents.php?agreements=pcidss&amp%3Bassociation=pcidss https://www.pcisecuritystandards.org/security_standards/documents.php?agreements=pcidss&amp%3Bassociation=pcidss https://www.pcisecuritystandards.org/security_standards/documents.php

2. Auditor Independence

3. Corporate Responsibility

4. Enhanced Financial Disclosures

5. Analyst Conflicts of Interest

6. Commission Resources and Authority

7. Studies and Reports

8. Corporate and Criminal Fraud Accountability

9. White-Collar Crime Penalty Enhancements

10. Corporate Tax Returns

11. Corporate Fraud Accountability

SOX requirement guidance:

- http://www.soxlaw.com/

- http://www.gpo.gov/fdsys/pkg/PLAW-107publ204/content-detail.html

The U.S. Electronic Communications Privacy Act, The U.S. Stored Communications Act

The U.S. PATRIOT Act The Electronic Communications Privacy Act (ECPA) and the Stored Communications Act (SCA) create statutory privacy rights for people’s electronic communications stored by a third-party service provider in “electronic,” “computer,” “temporary” or “intermediate” storage.

Certain types of electronic communications (unread mail that is newer than 180 days) may only be obtained by law enforcement from a service provider via a search warrant.

Other electronic communications and user information may be more easily obtained by law enforcement from a third party provider by a court order or subpoena. Any communications may be obtained by law enforcement from a third party provider if the end user has provided consent. End users should be careful not to give such consent by clicking through a Terms of Use and/or Privacy Policy or by signing a contract. The PATRIOT Act allows law enforcement to obtain or intercept electronic communications and other end user data from third-party service providers for terrorism investigations using protocols that are less stringent than those that would normally apply.

• U.S. Electronic Communications Privacy Act https://it.ojp.gov/default.aspx?area=privacy&page=1285

• U.S. Stored Communications Act https://uscode.house.gov/view.xhtml?path=/prelim@title18/part1/chapter121&edition=p relim

• U.S. PATRIOT Act http://www.justice.gov/archive/ll/highlights.htm Bottom of Form http://www.soxlaw.com/ http://www.gpo.gov/fdsys/pkg/PLAW-107publ204/content-detail.html https://it.ojp.gov/default.aspx?area=privacy&amp%3Bpage=1285 http://www.justice.gov/archive/ll/highlights.htm

PRIMARY SECURITY AND PRIVACY MANDATES