Industry Resources
The documents included in this section are provided as references on topics related to compliance, security and/or IT operations.
Guidance for Enforcement of CIP Standards - North American Electric Reliability Corporation (NERC)
Publication from NERC that was created to clarify the NERC CIP implementation plan and to provide guidance to the industry on when penalties and sanctions apply. It contains a 4 page guidance document and is attached to the 11 page "(Revised) Implementation Plan for Cyber Security Standards CIP-002-1 through CIP-009-1". Published May 2008. Download PDF
Guide to Computer Security: Log Management Recommendations of the National Institute of Standards and Technology (NIST)
Recommendations of the The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST)National Institute of Standards and Technology (NIST) for log management. Published September, 2006. Download PDF
Payment Card Industry (PCI) : Data Security Standard
Document that describes the 12 Payment Card Industry (PCI) Data Security Standard (DSS) requirements. These PCI DSS requirements are organized in 6 logically related groups, which are “control" objectives. Version 1.1 of the PCI Data Security Standard, published September 2006. Download PDF
Payment Card Industry (PCI) : Data Security Standard - Security Scanning Procedures
Document that explains the purpose and scope of the Payment Card Industry (PCI) Security Scan for merchants and service providers who undergo PCI Security Scans to help validate compliance with the PCI Data Security Standard (DSS).Version 1.1 of the PCI DSS, published September 2006. Download PDF
Federal Information Security Management Act (FISMA) 2004 Report to Congress
Document that describes The Federal Information Security Management Act (FISMA) and outlines the specific responsibilitiesassigned to Federal agencies, the National Institute of Standards and Technology (NIST) and the Office of Management and Budget (OMB) in order to strengthen information system security. From the OMB, Published March 1, 2005. Download PDF
Gramm-Leach-Bliley S. 900, Financial Services Modernization Act- Summary of Provisions
Document that provides a summary of the provisions of S. 900 -- Financial Services Modernization Act of 1999 or the Gramm-Leach-Bliley (GLBA) published by the Senate Banking, Housing, and Urban Affairs Committee November, 1999. Download PDF
Health Insurance Portability and Accountability Act (HIPAA) Security Act Guidance for access to Electronic Protected Health Information (EPHI)
Document provides guidance to reinforce strategies for HIPAA covered entities to protect EPHI when it is accessed or used outside of the organization’s physical purview, related to the use of laptops, other portable and/or mobile devices and external hardware that store, contain or are used to access the data. Published by the The U.S. Department of Health and Human Services (“HHS”), December, 2006. Download PDF
Summary of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule - Office for Civil Rights (OCR) Privacy Brief
Document that describes The Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”), a set of national standards for the protection of certain health information as required by the HIPAA of 1996. The brief was last revised May, 2003 by Office of Civil Rights (OCR) within the The U.S. Department of Health and Human Services (“HHS”). Download PDF
Sarbanes-Oxley Act of 2002
Document is the actual Sarbanes-Oxley (SOX) congressional act published January, 2002. Download PDF
The Complete Guide to SOX- Understanding how Sarbanes-Oxley Affects your Business
Document describes the background of Sarbanes-Oxley (SOX) and explains the regulation impacts organizations. The author reviews and areas of concern to priotritize planning for SOX compliance. The Complete Guide to Sarbanes Oxley by Stephen Bainbridge, UCLA School of Law, Law& Economics Research Paper Series. Published 2007. Download PDF
Introduction to Network and Host Based Intrusion Detection
A comprehensive overview of the fundamental computer security controls of prevention, detection and correction. Author: Chris Petersen, Chief Technology Officer of LogRhythm. Download PDF