IT Regulatory Compliance in North America: A Pocket Guide

By: Alan Calder

Sign Up Now! Already a Member? Log In
You must be logged into Bookshare to access this title. Learn about membership options, or view our freely available titles.

Synopsis: This pocket guide provides initial guidance to all who are concerned with IT regulatory compliance in North America. A key challenge for all IT executive teams is to ensure that the organization avoids breaches of any criminal or civil law, as well as any statutory, regulatory or contractual obligations, and of any security requirements. Control A.15.1.1 of ISO/IEC27001:2005 (the best-practice information security management standard) provides guidance that is relevant to the IT governance of every organization. It says that the organization should explicitly define and document the statutory, regulatory and contractual requirements for each of its information systems, and that this documentation should be kept up-to-date to reflect any relevant changes in the legal environment. The specific controls and individual responsibilities to meet these requirements should be similarly documented and kept up-to-date, and should be linked to the list of all the data assets and processes in the organization, together with their ownership details.