Information Security Awareness and Training... Yes, it's required.

Over the years, one of the questions I have been asked most frequently is, "Do we really need to have an Information Security awareness and training program?"  The question is often followed up by a statement calling into question the perceived value of awareness and training.  My standard response is typically along the lines of, "Yes.  It is required and, perhaps more importantly, the right thing to do." 

Setting aside the value-based approach of 'doing the the right thing' to keep information secure and private, most people are surprised to learn Information Security awareness and training is a compliance obligation often required by law, industry regulation, and or business contract.  Additionally, it is called out in numerous 'best practice' frameworks. 

So, in the spirit of ongoing Information Security awareness and to assist those who have requested more information on this subject, I've decided to list a just a few of the numerous laws, regulations, and frameworks applicable to North America.  Bear in mind some are industry specific.  I hope this proves helpful.

Laws and Regulations (North America)

Health Information Portability and Accountability Act (HIPAA):   §164.3

Canada Personal Information Protection Electronic Documents Act (PIPEDA):   Schedule 1 Clause 4.1.4(c), Scedule 1 Clause 4.7.4

Privacy Act of 1974:   §552a(e)(9)

Fair and Accurate Credit Transactions Act (FACTA):   §151, §213(d)

FACTA Red Flag Rule:   §41.90(e)(3), §222.90(e)(3), §334.90(e)(9), §571.90(e)(9), §681.2(e)(9), §717.90(e)(9)

Leahy Personal Data Privacy Security Act:   §302(b)

Tlaxcala Law:   Article 27

FFIEC Information Security:   Page 7, Page 62

NERC:   CIP-004-1

FDA 21 CFR Pt 11:   §11.10(i)

Massachusetts 201 CMR 17.00:   §17.04(8)

 

Business Contracts

Payment Card Industry Data Security Standard (PCI DSS):   §12.6

 

'Best Practice' Frameworks

ISO 17799 / ISO 27002:   §8.2.2

ITIL Security Management:   §4.2.2.2

AICPA Privacy:   ID 1.1.1

NIST 800:  numerous sections 

 

(Important Note: Compliance obligations are not 'one size fits all'.  What one organization must be compliant with may not hold true for another organization, even if they are within the same industry.  It is aboslutely essential to develop an organization specific compliance framework reflective of all compliance obligations known to the organization.)