TIM-8720: Industry Laws, Regulations, and Compliance

Federal Financial Institutions Examination Council. (2016, September). II.C.4 control implementation. In FFEIC Information Technology Examination Handbook.
This resource gives guidance on how controls should be implemented to align with the organization’s security.

Federal Deposit Insurance Corporation. (n.d.) Internal routine and controls.
This resource highlights five key components that financial institutions' internal control programs should address.

ISO 27001 Security. (2022). ISO27k information security.
This resource provides an index and brief introductions of all notable ISO27000-range standards. Focus on ISO/IEC 27002 and 27005 if this is relevant for your selected organization.

Carnegie Melon University. (2019). Selecting security controls.
This resource highlights different controls available to mitigate cyber threats.

National Institute of Standards and Technology. (n.d.). SP 800 series. Computer Security Resource Center.
This resource highlights different NIST special publications available. Scroll to the SP800-53 entries and use the most current version of SP800-53. Only review the document for your desired controls and only those areas relevant to your organization.

U.S. Department of Health and Human Services. (2021, May 17) Summary of the HIPAA security rule.
This resource summarizes key elements of the security rule, including who is covered, what information is protected, and what safeguards must be in place to ensure appropriate protection of electronically protected health information.

Lively, T. (2022, March 24). U.S. state privacy legislation tracker.
This resource highlights several states’ privacy laws and regulations.