text: Rules of Engagement and United States Code
  Table B-2. Federal cyberspace security laws and policies protecting United States citizens
  Name Description
  Sarbanes-Oxley (SOX) (U.S. Requires organizations in the U.S. to prove their cybersecurity*
  Code 15, Chapter 98) credentials. It applies only to public companies.
  Securities and Exchange Privacy of consumer financial information and safeguarding personal
  Commission (SEC) Regulation information. A security regulation that requires appropriate
  S-P (Code of Federal cybersecurity* measures. Applies to all U.S. and foreign brokers,
  Regulations 17, Part 248, dealers, investment companies, and investment advisers that are
  Subpart A) register with the Securities and Exchange Commission.
  Gramm-Leach-Bliley Act Is both an information security and privacy law, and applies to financial
  (GLBA) (U.S. Code 15, institutions and includes banks, insurance companies, security firms,
  Subchapter I) non-bank mortgage lenders, auto dealers, and tax preparers.
  Federal Trade Commission Act, Both an information security regulation requiring appropriate
  Section 5 (U.S. Code 15, cybersecurity measures and a privacy law. Applies to almost every
  Section 45) organization in the U.S. with the exception of banks and common
  carriers
  Health Insurance Portability and Has security, privacy, and breach notification rules. Applies to health
  Accountability Act (HIPAA) care providers, health plans, health care clearinghouses, and in
  (Code of Federal Regulations certain cases, business associates of these types of businesses called
  45, Part 160 and 164 covered entities. As a result, this Act can cover organizations as
  diverse as health insurance companies and pharmaceutical
  companies.
  Defense Federal Acquisition A cybersecurity* regulation that applies to the U.S. Department of
  Regulation (DFAR) (Code of Defense contractors. Requires contractors and subcontractors that
  Federal Regulations 48, process, store, or transmit defense information to provide adequate
  252.204-7012) security to safeguard on unclassified information systems.
  Children’s Online Privacy Is both a privacy and cybersecurity law that applies to websites and
  Protection Act (COPPA) (U.S. online services that are directed at children under the age of 13. Also
  Code 15, Chapter 91, and Code applies if the operator of the site as actual knowledge that children
  of Federal Regulations 16, Part under the age of 13 are using a website. Regulates how such websites
  312) collect, use, and/or disclose personal information from and about
  children.
  Federal Protection Act of 1974 Applies only to agencies of the U.S. Federal Government and governs
  (U.S. Code 5, Chapter 5, the collection, maintenance, use, and dissemination of personally
  Section 552a) identifiable information about individuals that is maintained in systems
  or records by federal agencies. It prohibits the disclosure of
  information from a system of records controlled by the federal agency
  without written consent of the subject individual, unless the disclosure
  is permitted under one of 12 statutory exceptions. This applies to all
  individuals that are residents of the U.S. (both lawfully or unlawfully)