Data Privacy ebook

Strategic Steps

for

Effective Compliance with Global

Data Privacy and Protection

Laws and Regulations

Information Intelligence and Trends:

Global Trends on Key Strategic Global Privacy, Data Protection and Regulatory Compliance

Information and Solutions

This significant milestone eBook—Strategic Steps for Effective Compliance with Global Data Privacy and Protection Laws and Regulations by Global Info Intel, consists of comprehensive and expert knowledge base, extensive resources and intelligent techniques for achieving effective, efficient and cost-effective data protection and privacy for all major global regulations. The expert solutions are based on many years of practical consulting for all Business, IT, data and application product environments for all industries. This important time-saving ebook is a consolidation of strategies that have proven effective in analysis, development, implementation, maintenance, monitoring, remediation and optimization of effective operating controls for compliance with State, Federal and Global laws and regulations and International Industry Best Practices.

What you will learn
This eBook covers key Strategic Global Privacy, Data Protection and Regulatory Compliance, and applies to all users of information assets. This includes the control environment of an organization. These Strategic Steps for Global Privacy, Data Protection and Regulatory Compliance define the critical environments and control mechanisms and essential steps for achieving and maintaining effective Privacy, Data Protection and Regulatory Compliance in a global context.
This ebook provides you with a single time-saving resource that addresses important and useful global information on Data Protection and Privacy that you will find both vital and indispensable for regular use. We also reference key resources and expert information.
You will find information on GlobalinfoIntel very stimulating, providing you with cost-saving tips and free analysis on rapidly emerging global information and trends with solutions and recommendations for meeting challenges and solving both common and complex problems on Global Privacy, Data Protection and Regulatory Compliance

Testimonial

"These e-books are very useful because they provide a consolidated, detailed perspective of the broad field of information security governance. There is a lot of information and detail."
Dr. Ulrich Lang, CEO & Co-Founder of ObjectSecurity, PhD Cambridge University, UK, MSc Information Security, University of London Royal Holloway, Information Security Group



This ebook provides the most strategic approach for achieving effective compliance with Global Regulations, Frameworks, Standards and Best Practices including the following:

Frameworks Mapped and Multi-Mapped: All Global Regulations including COBIT, COSO, ITIL, ISO, BS17799, ISO17799, ISO27001, ISO27002, ISO27003, ISO27004, ISO27005, ISO27006, ISO27007, CMMI, FISMA, Six Sigma, IATF, TOGAF, SDLC Frameworks, etc.

Regulations: All Global Regulations including: Sarbanes-Oxley, JSOX, HIPAA, GLBA, Privacy, SB1386, PCI, CISP, FDA-CFR-21-11, SAS70-Type II, Basel II, Safe Harbor, Data Protection and Privacy Laws and Regulations, Breach Notification Laws and Regulations; Global Regulations including North American (US, Canada and Mexico), European, European Union (EU), Asia-Pacific, Latin and South America, Middle East, Africa, APEC including Australia and New Zealand, etc.
Industry Standards: All Global Standards including ISO, IEEE, IEC, JTC, IEEE SC27, ISO ISO27001 to ISO 27058, NIST, FIPS, Information Security Standards, Data Protection and Privacy Standard, Breach Notification Laws and Regulations, etc.

Best Practices: Information Security: Local, State, Federal and International Standards

Internal Controls and Security: Policies, Control Objectives, Standards, Processes, and Procedures, Guidelines, Checklists and Key Controls.

IT General Controls: Access to Program and Data, Program Change, Change Management, Configuration Management, Program Development, SDLC, Computer Operations, etc.

Compliance Phases: Risk Assessments, Risk Control Matrices, Gap Analysis, Remediation, Automation, etc.

Security and Privacy: Auditing Objectives and Consolidation of Key Controls, Periodic, Regular and Annual Auditing, Documentary Evidence for Compliance with any Global Regulation or Standard or Framework, etc.

Infrastructure Security: Intrusion Detection, Prevention and Response Systems (IDS, IPS, IRS) VPN, Enterprise Systems, Firewalls, Applications, Networks, Databases, Monitoring Traffic, etc.

Correlation, Data Mining, Reality Mining, AI, Algorithms: Data and Traffic Analysis for Security, Intrusion/Attack Responses, Reclassification of Alerts for False Positives, Benign Traffic and Alert Filtering; Packet Analysis, Statistical and Signature Detection Mechanisms, Normal Traffic, Anomaly and Misuse Detection, Prevention and Response; Accurate Threshold and Packet Rate Limit Settings; Pattern Analysis of Long-term and Short term Traffic in Enterprise Infrastructure environments; Risk and Attack Mitigation, Impact Containment, Forensics, etc.

Testing: Test and Re-Test Plans, Test Processes and Procedures, Test Cases, Test Reports, Test Results, Acceptance Reports, Validation and Attestation Reports for effective operating controls, etc.

Internal and External Auditing for Compliance: Application, Product, Data and IT.



Table Of Contents

1     Purpose of Strategic Global Privacy, Data Protection and Regulatory Compliance. 18
2     Scope. 18
3     Key Areas for Current and Future eBooks: www.globalinfointel.com. 19
4     Additional Topics and Articles 20
5      Definitions of Terminology. 22
Definition of Data Protection. 22
Definition of Compliance 22
Control Objective for IT Definitions. 22
Data and Asset Security Classification. 25
5.1          Introduction to Privacy 27
6      Introduction to Global Data Privacy and Protection. 30
7     Major Areas of Global Strategic Global Privacy, Data Protection and Regulatory Compliance. 33
8     Privacy and Data Protection Controls 40
9     Major Phases of Regulatory Compliance for Privacy and Data Protection Requirements 41
Phase 1: Privacy and Data Protection Requirements Strategic Analysis and Implementation. 41
Summary Strategic Steps for Global Regulatory Compliance: 41
Major Phases of Regulatory Strategy. 41
9.1          Phase 1: Privacy and Data Protection Requirements Strategic Analysis and Implementation 41
9.2          Phase 2: Privacy and Data Protection Requirements Implementation 43
9.3          Phase 3: Privacy and Data Protection Requirements Attestation for Compliance 47
9.4           Summary of Effective Strategy for developing Effective Critical Key Controls for Privacy and Data Protection Requirements 49
10          Summary of Phases towards Strategic Global Regulatory Compliance. 51
11      Key Areas of MDM Data Protection and Privacy, Regulatory Compliance Security and Auditing 54
11.1          Master Data Management (MDM) 54
Key Areas of Implementation for MDM Controls towards Data Protection and Privacy, Global Regulatory Compliance and Best Practices 54
11.2          MDM Best Practice Key Security and Control Areas 55
12      Global Privacy and Data Protection Regulatory Requirements 64
Controls and Supporting Documentary Evidence for Effective Compliance Summary 64
12.1          Rapid Remediation of Current Critical Issues, Risks and Gaps 64
12.2          Full Documentary Evidence for Current Effective Operating Controls 65
12.3          Full Requirements for Privacy and Data Protection Regulatory Requirements and Security Controls, Verified and Validated Supporting Serious Documentary Evidence: 72
13      Key Controls for Global Data Protection and Regulatory Compliance: Sarbanes-Oxley SOX, J-SOX (Japan SOX), E-SOX (European SOX), K-SOX (Korea SOX), Asia-Pacific, etc. 78
13.1 Key Controls for Data Protection and Regulatory Compliance 79
13.2 Key Controls for Data Protection and Regulatory Compliance Continued. 79
13.3 Key Controls for Data Protection and Regulatory Compliance Continued. 81
13.4 Key Controls for Data Protection and Regulatory Compliance Continued. 82
13.5 Key Controls for Data Protection and Regulatory Compliance Continued. 83
13.6 Key Controls for Data Protection and Regulatory Compliance Continued. 84
13.7 Key Controls for Data Protection and Regulatory Compliance Continued. 85
13.8 Key Controls for Data Protection and Regulatory Compliance Continued. 86
13.9 Key Controls for Data Protection and Regulatory Compliance Continued. 87
13.10 Key Controls for Data Protection and Regulatory Compliance Continued. 88
13.11 Key Controls for Data Protection and Regulatory Compliance Continued. 89
13.12 Key Controls for Data Protection and Regulatory Compliance Continued. 90
13.13 Key Controls for Data Protection and Regulatory Compliance Continued. 91
13.14 Key Controls for Data Protection and Regulatory Compliance Continued. 92
13.15 Key Controls for Data Protection and Regulatory Compliance Continued. 92
13.16 Key Controls for Data Protection and Regulatory Compliance Continued. 94
13.17 Key Controls for Data Protection and Regulatory Compliance Continued. 95
13.18 Key Controls for Data Protection and Regulatory Compliance Continued. 96
13.19 Key Controls for Data Protection and Regulatory Compliance Continued. 97
13.20 Key Controls for Data Protection and Regulatory Compliance Continued. 98
13.21 Key Controls for Data Protection and Regulatory Compliance Continued. 99
14          Strategic Data Privacy and Protection, Security and Compliance: 100
Introduction. 100
Important explanation of Privacy compliance: 102
Important explanation of Global Privacy and Compliance Strategic Approach. 103
Strategic Approach for Effective Compliance with Global Privacy and Protection Laws and Regulation Using Multi-Mapping. 104
15      Global Data Privacy and Security Compliance. 106
Phase 1: Multi-Mapping to Regulations and Standards 106
15.1 Data and Application Product Categories. 106
15.1.1             Enterprise Applications 106
15.1.2             Company ERP 106
15.1.3             Company ERP Human Capital Management 106
15.1.4             Company ERP Financials 106
15.1.5             Company Product Lifecycle Management 106
15.1.6             Company Supply Chain Management 106
15.1.7             Company Supplier Relationship Management 106
15.1.8             Company Manufacturing 106
15.1.9             Company Service and Asset Management 106
15.1.10             Enterprise service-oriented architecture (SOA) 106
15.1.11             Company Enterprise platform 107
15.1.12             Company Enterprise Business Intelligence 107
15.1.13             Company Enterprise Exchange Infrastructure 107
15.1.14             Company Enterprise Master Data Management 107
15.1.15             Company Enterprise Portal, Mobile 107
15.1.16             Company Enterprise Application Servers and Data Servers 107
16      Global Data Privacy and Security Compliance. 107
Phase 2: Auditing Privacy and Security Controls for Regulatory Compliance. 107
16.1 Auditing Security and Privacy Features. 107
16.1.1             Audit Dataset Security and Privacy Features for Regulatory Compliance 107
16.1.2             Perform Risk Assessments in Data and Application Code Security 107
16.1.3             Perform Gap Analysis of IT Controls for Regulatory Compliance 107
16.1.4             Perform Gap Analysis of Regulatory Compliance Features 107
16.1.5             Perform Gap Analysis of Regulatory Compliance Functions 107
Developing Test Plans. 107
16.1.6             Develop Data and Application Security Test Contents 107
16.1.7             Develop Data and Application Security Test Contents 107
16.1.8             Test Procedures Based on Global Policies, Standards and Regulations 107
Validation and Attestation. 107
16.1.9             Perform Data and Application Code Security Validations: Best Practice 107
16.1.10             Perform Data and Application Code Security Testing: Best Practice 107
16.1.11             Perform Data and Application Code Security Vulnerability Assessments 107
16.1.12             Perform Data and Application Code Security Vulnerability Scans 108
16.1.13             Perform Data and Code Security Testing: Preventions for Application Attacks 108
Privacy and Security Validation. 108
16.1.14             Review Data and Application Security Validation 108
16.1.15             Pre-Review Activities for Data and Application Security 108
16.1.16             Provide Security Requirements for Data and Application 108
16.1.17             Record Results for Data and Application Privacy and Security 108
Data and Application Privacy Information. 108
16.1.18             Analyze Data and Application Privacy and Security Information 108
16.1.19             Review Application Source Code Information 108
16.1.20             Review Server, Data and Application Privacy and Security 108
Major Data and Application Security and Privacy Validation Areas. 108
16.1.21             Identification and Authentication, Authorization, Accounting 108
16.1.22             Data and Application Privacy and Security Servers should use Public 108
16.1.23             Application and Data Servers utilizes International Standards 108
16.1.24             Application and Data authenticate with valid certificates 108
16.1.25             Application and Data servers permit access to authorized users 108
16.1.26             Certificates Management should be based on AES Standards 108
16.1.27             User Account Management should be based on Best Practices and 108
ISO 27001–27058 Standards 109
16.1.28             Unique Application and Data Access user IDs 109
Data and Privacy Protection. 109
16.1.29             Sensitive application and data should be adequately protected at rest. 109
16.1.30             Sensitive application and data should be adequately protected in transit. 109
16.1.31             Application should use approved cryptographic module. 109
16.1.32             Sensitive information in application and database should be protected from unauthorized access and monitored for detection, prevention and response 109
Network Infrastructure Environment 109
16.1.34 Application, Data and Network architecture should not exposes resources that reside inside VPN. 109
16.1.35 DMZ Periphery of Networks 109
16.1.36 Internal and External Periphery. 109
Test Reports for Remediation of Data and Application Security Validation Gaps. 109
16.1.37 Test Validation Results Reports 109
16.1.38 Data and Application Security Test Results Evaluation. 109
16.1.39 Data and Application Security Major Priority Gaps 109
16.1.40 Data and Application Security Medium Priority Gaps 109
16.1.41 Data and Application Security Low Priority Gaps 109
16.1.42 Data and Application Security Functions Gaps Analysis 109
16.1.43 Data and Application Security Vulnerabilities Analysis 109
Data and Application Security Regulatory Compliance Gaps and Remediation. 110
16.1.44 Data and Application Security Regulatory Compliance Remediation. 110
16.1.45 Data and Application Security Best Practice. 110
Internal and External Audit Validation. 110
16.1.46 Internal Audit: Compliance Validation Attestation. 110
16.1.48 Internal Audit: Compliance Validation Reports 110
External Auditors’ Evidence Reports for Compliance Validation. 110
16.1.49 External Audit Compliance Validation Attestation. 110
16.1.50 Internal Audit Compliance Validation Reports 110
Data Privacy and Application Security Global Standards Validation. 110
16.1.51 Internal Audit: Global Standards Compliance Validation Attestation. 110
16.1.52 External Audit: Global Standards Compliance Validation Reports 110
Data Privacy and Application Security Dependencies Analysis. 111
Data and Application Security: Attacks Gap Analysis 111
17. Global Data Privacy and Security Compliance. 112
Phase 3: Developing Data Privacy Policies, Standards, Processes and Procedures 112
17.1 Development of Data Privacy and Application Security Policies, Standards, Processes and Procedures. 112
17.1.7 Develop Data, Privacy and Application Documentation for Developers: 115
Frameworks, Regulations and Standards including the following: 115
18. Global Data Privacy and Security Compliance. 117
Phase 4: Remediation. 117
18 Remediation of Gaps in Data Privacy and Protection. 117
18.1 Remediation of Gaps: Data and Privacy Gaps based on Compliance. 117
Mapping, Security and Privacy Implementation, Auditing Standards and results in Phases 1, 2 and 3: 117
18.2 Remediation of Data, Privacy and Application Security Validation Gaps 117
18.3 Remediation of Data, Application Security Regulatory Compliance Gaps 117
18.4 Remediation of Data, Application Security on Internal and External Audit Validation. 118
18.5 Remediation based on External Auditors’ Evidence Reports for Compliance Validation. 118
18.6 Remediation based on Data, Privacy and Application Security Global Standards Validation. 118
18.7 Remediation based on Data and Application Security Dependencies Analysis 119
18.8 Remediation based on Data and Application Security: Attacks Gap Analysis 119
18.9 Remediation based on Data and Application Security Policies, Standards, Processes and Procedures 120
19. Detailed Explanation of Privacy and Data Security Implementation. 122
20. Detailed Explanation of Privacy and Data Protection Regulatory Compliance. 123
20. Detailed Explanation of Privacy and Data Protection Regulatory Compliance. 124
20.1 Strategic Privacy and Security Compliance Spreadsheet 125
Detailed Explanation of Contents (Tabs) of Compliance Spreadsheet 125
Spreadsheets and Tabs Explanation for Security and Privacy compliance: 126
Specific Target Group Audience. 127
20.2 Guidelines for Compliance: The Effective Implementation of Controls to Achieve Privacy, Data Security and Compliance 130
21. US European and Global Privacy and Security Regulatory Compliance: 136
21.1 Important Explanation of Multi-mapping. 136
21.2 Important Explanation of Multi-Mapping. 137
21.3 Important Explanation of Multi-Mapping for Privacy and Data Protection. 138
21.4 Explanation of Phases 2-4: Testing, Documentation, Remediation, Auditing and compliance will be explained in detail in Phases. 141
22 Global Standards and Regulations: European, US, Asia Pacific and other International Standards and Regulations, including US, Canadian and International Standards and Regulations 142
22.1 Explanation of Column Definitions. 142
22.2 Privacy and Security Requirements for All Company Product Applications for Compliance with Multi-Mapped Regulations and Standards. 143
European Data Privacy Regulations 144
·    EU Directive 2002/58/EC. 144
·    CA SB1386 – Mapping of Company Product categories, subcategories and features to California SB1386 Regulation Federal S1350 – Mapping of Company Product categories, subcategories and features to Federal S1350 Regulation. 145
·    FDA-CFR21-11 – Mapping of Company Product categories, subcategories and features to FDA-CFR21-11 Regulation. 145
·    ITIL – Mapping of Company Product categories, subcategories and features to ITIL Standard. 145
·    PCI – Mapping of Company Product categories, subcategories and features to PCI Standard. 145
·    ISO 17799-2005 – Mapping of Company Product categories, subcategories and features to 17799-2005 Standard. 145
·    ISO-IEC 27001 – Mapping of Company Product categories, subcategories and features to ISO-IEC 27001 Standard. 145
·      IEEE16805 Risk Management – Mapping of Company Product categories, subcategories and features to IEEE16805 Risk Management Standard. 146
·    SAS70 Type II – Mapping of Company Product categories, subcategories and features to SAS70 Type II Standard. 146
·    TR13335 – Mapping of Company Product categories, subcategories and features to IEEE TR13335 Standard. 146
·    NIST 800-14 – Mapping of Company Product categories, subcategories and features to NIST 800-14 Standard. 146
·      CommonCriteria15408-2005 – Mapping of Company Product categories, subcategories and features to the Common Criteria15408-2005 Standard. 146
22.3 Company Product Security Compliance Mapping to Global Regulations and Standards. 146
22.4 Global Standards and Regulations: European, US, Asia Pacific and other International Standards and Regulations. 148
1. COBIT. 148
2. COSO. 148
3. Sarbanes-Oxley Act Sections 404 and 302, 2002. 148
3.1 J-SOX: Japanese SOX- Japanese Version of SOX. 148
3.2 SOX and J-SOX Objectives. 149
3.3 SOX and J-SOX Elements. 149
4. HIPAA. 149
5. GLBA. 149
6. Privacy – 16 CFR 313. 150
7. CA SB1386. 150
7.1 COPPA. 150
8. Federal S1350: US Federal Privacy Law: NORPDA. 150
8.2 Canada version of Privacy 150
9. FDA-CFR21-11. 151
10. ITIL 151
11. PCI /CISP. 151
11.1 ESA. 151
12. ISO 17799-2000. 151
13. ISO / IEC 27001. 152
14. IEEE16805. 152
15. SAS70 Type II 152
16. IEEE TR13335 Standard. 152
17. NIST 800-14, 800-53 Information Security Standards. 152
18. Common Criteria15408-2005 Standard. 152
22.5 European and US Privacy and Security Regulatory Compliance: Refer Also to Multi-mapped to Global Regulations, Standards and Frameworks on Security and Privacy for Global Regulatory Compliance 153
19. Directive 2002/58/EC. 153
20. EU - Law: 153
21. EU - Law: 153
22. EU - Regulations: 155
ISO20000. 155
ISO 20000-2: 155
German Laws and Regulations. 155
23. Germany - Law: KonTraG. 155
24. Germany - Codex. 157
German Corporate Governance Codex. 157
25. Germany - Law: IDW PS 261. 157
IDW PS 261: Das Institut der Wirtschaftsprüfer (IDW) 157
26. Germany - Law: IDW PS 331. 158
IDW PS 331: Das Institut der Wirtschaftsprüfer (IDW) 158
27. Germany - Law: Data Secrecy 159
Data Secrecy (Geheimschutz) 159
28. Germany - Law: BDSG. 159
Data protection act (BDSG) 159
29. Germany - Law: KWG. 160
KWG §25: Gesetz über das Kreditwesen -Kreditwesengesetz. 160
UK Laws and Regulations. 161
30. UK - Law: FRAG 21. 161
31. UK – Law: 162
Data Protection Act of 1998 and the Privacy and Electronic Communications (EC Directive) Regulations 2003. 162
32. UK - Law: 162
BS7799: ISO17799 and ISO27001 with BS7799 requirements. 162
Switzerland. 162
33. Switzerland - Law: Privacy 162
Canada. 164
34. Canada - Law: Section 5900. 164
US Laws and Regulations. 165
35. US - Regulation: 165
FISMA - Federal Information Security Management Act of 2002. 165
35.1 EFTA. 166
Electronic Funds Transfer Act 166
35.2 ESA. 166
Exchange and Securities Act 166
35.3 CFR21. 166
Title 21 Code of Federal Regulations 166
35.4 NERC CIP. 166
36. US - Law: 166
ITAR - International Traffic in Arms Regulations. 166
37. US - Regulation: 167
DoD: DoD Privacy Act Implementation. DoD Directive 5400.11 · DoD Regulation 5400.11-Regulation. 167
37.1 DCID. 168
Director of Central Intelligence Directive 6/3. 168
38. US - Regulation: 168
FIPS - Federal Information Processing Standards. 168
39. US - Regulation: 169
C-TPAT - U.S. Customs -Trade Partnership Against Terrorism. 169
US - Laws: Privacy and Data Protection Acts. 170
40. Privacy act of 1974. 170
41. Freedom of information Act (FOIA) of 1967. 170
E-Government Act of 2002 - Legal framework for protection of privacy and personal data. 170
43. US/EU - Regulation: 171
Data secrecy (NATO clearance) 171
44. US - Law: 171
US Patriot Act 171
45. US - Regulation: 172
CFTC - Commodity Futures Trading Commission (CFTC) 172
ISO Product Security Standards. 172
46. ISO/IEC CMMI 120705v4; SE/SW - Software Security 172
47. CMMI® for Development, Version 1.2, 2006, 2007; CMU/SEI-2006-TR-008 ESC-TR-2006-008. 173
48. SIX sigma process improvement 174
49. ISO/IEC/ IEEE 12119: Requirements for Software product evaluation. 174
ISO Security Management Standards. 176
50. ISO/IEC 27005 Information Security Management System and Privacy Requirements. 176
Banking Industry Regulations. 177
51. Basel II: Basel Capital Accord: European requirements for banks for managing risks of issuing loans. 177
52. IAS 32: IAS – International Accounting Standards framework adopted by European. 178
53. IAS 39: IAS – International Accounting Standards framework adopted by European. 179
54. SEPA compliance – Single Euro Payment Area (SEPA) framework as defined by European Payment Council (EPC) for transparency of payment processes. 179
Privacy Regulations. 180
55. EU Directives. 180
55.1. EU 91/356 Directive 180
55.2. EU 200/520 Directive 180
2000/520/EC: 180
55.3. EU 2002/58 Directive 180
55.4. EU 97/66 Directive 181
55.5. EU 2003/98 Directive 181
Chemical Industry Regulations. 182
56. Product Safety 182
57. Dangerous Goods Management 182
58. Industrial Hygiene and Safety management 182
59. Occupational Health. 183
Consumer Products Industry Regulations. 184
Food Regulations: 184
61. Bioterrorism Act 184
62. General Food Law Regulation 178/2002. 184
Manufacturers of electrical and electronics equipment - High Tech Industry Regulations. 184
63. Restriction of Hazardous Substances (RoHS) 185
65. Other regulations for electronics manufacturers: 185
The Pharmaceutical; Medical, etc: Life Sciences Industry Regulations. 185
Electronic Records and Signatures. 185
66. ICH Q7A Guideline 185
67. EU Directive 91/356 (EU GMP Guideline) 186
68. FDA 21 CFR Part 11. 186
69. PIC/S: The Pharmaceutical Inspection Convention and Pharmaceutical Inspection Cooperation Scheme 186
70. ISO/IEC Radio. 186
71. ISO/IEC FDA Bar Code Label Requirements. 186
72. Procedure for Handling Rapid Alerts and Recalls Arising from Quality Defects. 187
73. Radio frequency Identification Feasibility Studies and Pilot Programs for Drugs. 187
74. U.S. state regulations. 187
Automotive industry Regulations. 187
Automotive Regulations. 187
75. Automotive: ISO/TS 16949 ISO Quality System. 187
76. TREAD) Act and ISO/TS 16949. 187
ISO Quality Management Standards. 188
77. ISO/IEC 9001:2000 78. ISO/IEC 9000–9003:2003 79. ISO/IEC 9000–9003:2005. 188
ISO Risk Management Standards. 188
80. IEEE SESC Standards SEI CMMI 15288 for software systems. 188
81. ISO/IEC 15288 CM Risk Management Security and Privacy for software systems. 188
82. IEEE SESC Standards SEI CMMI 15504 for software systems consolidated into ISO/IEC JTC 1/SC27 security and privacy standards proposals. 188
Global International Standards Continued. 189
83. ISO/IEC JTC 1/SC27- A Privacy Framework: 189
23 GLOBAL PRIVACY AND DATA PROTECTION LAWS AND REGULATIONS. 190
European Privacy and Data Protection Laws and Regulations. 190
Specific Privacy and Protection Law: Privacy and Data Protection. 190
24 Related Areas: Links 191
25 All Areas: Links 191
26 Key Areas of Governance, Regulations, Risk Management, Compliance, Auditing. 192
26.1 Sarbanes-Oxley Rules. 192
17   TITLE I—PUBLIC COMPANY ACCOUNTING OVERSIGHT BOARD. 192
18      TITLE I—PUBLIC COMPANY ACCOUNTING OVERSIGHT BOARD 196
19      SEC. 806. PROTECTION FOR EMPLOYEES OF PUBLICLY TRADED 220
27 Tools and Resources: Information Security, Privacy, Data Protection. 228
27.1 Tools and Resource 228
·    Risk Assessments 228
·      Infrastructure, Network and Application Security. 228
·    Web security Vulnerability Scanning. 228
·      Ethical Hacking, Penetration Testing. 228
·      Code Review. 228
·      Event Correlation and Data Mining. 228
·      Forensics 228
27.2 Risk Assessments , Data Privacy and Protection. 228
27.1.1 Infrastructure, Network and Application Security, Web security Vulnerability Scanning, Code Review, and Ethical Hacking, Penetration Testing, Event Correlation and Data Mining, Forensics 228
27.3 Risk Assessments and ITIS. 229
27.3.1 Infrastructure, Network and Application Security, Web security Vulnerability Scanning, Code Review, and Ethical Hacking, Penetration Testing, Event Correlation and Data Mining, Forensics 229
27.4 Enterprise GRC, Information Security and Data Protection. 229
27.5 Enterprise Environment 230
27.6 Industrial Enterprise Environment 231
27.7 Engineering development Security and Compliance for Enterprise Engineering Products: 231
27.8 Firewalls. 231
27.9 Firewall Intrusion Detection, Prevention and Response Systems (IPS/IRS) 232
27.10 Enterprise systems. 232
27.11 Enterprise Security: SOA and MDM. 233
27.12 WebServers. 234
27.13 Engineering Security, Compliance, Data Protection and Privacy for Enterprise Systems- All Industries. 234
27.14 VPN Global security and architecture, design and deployment: 235
27.15 Application, Web, Network, Database and Operating Operating Vulnerability Assessements. 237
27.16 Code Review. 237
27.17 Application Security Code Reviews. 238
27.18 Application Scanning Tools. 238
27.19             Application vulnerability scanners 238
27.20 Application, Web and Network Testing Tools scanners. 239
28 Commercial Tools 239
28.1 Vulnerability Management: Penetration Testing (Pentesting) 240
29 Application Security, Event Correlation, Data Mining and Forensics: 241
30 Related Resources 241


Product price and special introductory offer
This is more than a typical book. It is a consulting resource that you can use immediately to implement effective controls for data protection and privacy within any organization or industry. It is based on nearly 30 years of professional experience. It is applicable to any business, IT, product or environment.

Furthermore, it can be used for stategic and effective compliance with any global regulation, standard or framework.

Technical documents in the consulting fields are often sold for well in excess of $1000. Although this book contains far more detail condensed into one accessible place, information that could advance your career and save your company money in this troubled economy,
we are offering it at the low price of just $149.95.

Also now for a limited time, students can get your copy
at the fantastically
low price of just $149.95

There is no waiting for shipping. As soon as your payment is processed, you will receive an e-mail with download instructions and product key. Don't wait, this introductory price could end at any time. Click on the "Purchase Now" icon below to be taken to our secure payment system.



Global Info Intel

Global Info Intel addresses emerging global trends on Information and Solutions. We provide cost-saving solutions for critical complex problems: Business, IT, Data, e-books, free articles, professional expertise, etc. Visit Global Info Intel regularly

Key Topics
Privacy, Risk, Information Security, Governance, Compliance, Regulations Standards, Frameworks, Auditing, Data Management, Data Mining & Reality Mining, Internet & Society

Global Info Intel -- Global Information Intelligence addresses Global Trends on Key Information and Solutions including but not limited to the following areas:
Global Regulatory Requirements and Compliance

IT and Business Internal Controls, Data Protection of Sensitive Data, Privacy, Information Security, Governance, Risk Management, Risk Assessments, Vulnerability Management, Compliance, Regulations, Standards, Frameworks, Auditing, Data Management, Data Mining, Reality Mining, Internet and Society, Effective Strategies of Multi-Mapping Compliance, Corporate Governance and Responsibility,
Corporate and Social Responsibility, Governance Controls and Oversight, IT Governance, Business Process Governance

Emerging Global Issues on Governance, Corporate Compliance, Strategic Comprehensive and Simultaneous Compliance with any Global Regulation, Information Security Policies, Control Objectives, IT General Controls, Homeland Security, Global Intelligence, Emerging Global Standards, Frameworks and Regulations

Most Strategic Global Corporate Compliance, Security and IT Governance:
The Most Comprehensive & Cost-saving Approach to Global Compliance: Security, Privacy, Risk Mitigation- All Products, Infrastructures, Industries
Multi-Mapped Over 350 Global Regulations, Standards & Frameworks:
Full Design & Implementation: All Industries, Enterprises, Applications, IT Security Research: Major IEEE Publications

http://www.globalinfointel.com

Global Info Intel: Global Information Intelligence

Intelligence and Solutions on Global Information Trends