Organizations have increasingly added compliance with security-related regulations and standards to their CSO's responsibilities. Understanding these is imperative for career advancement.
Organizations have increasingly added compliance with security-related regulations and standards to their CSO's responsibilities. Depending on the nature of the requirement, this may fully reside within the security department's scope or be jointly managed with other groups. Your organization may very well have obligations dictated by governments outside the US. As a security professional, it is imperative for you to understand the nature of these to advance your career. Being conversant in them and ensuring your company's program is aligned with and incorporates these requirements is critical. Maintenance of your continued education around these issues will help you recognize evolving patterns and predict the impact of what is coming next. Further, understanding the existence of those security related regulations and standards that are relevant to industries outside of your current employer will better prepare you if you shift your career into a different industry. Below are representative samples of regulations and standards we have identified within a variety of job descriptions relevant to security professionals: **US Regulatory:** Banking Act of 1933, Chemical Facility Anti-Terrorism Standards (CFATS), Customs-Trade Partnership Against Terrorism (C-TPAT), Dodd-Frank Act, DOT HM-232, HIPAA, Fair and Accurate Credit Transaction Act (FACTA), Fair Credit Reporting Act (FCRA), FERPA, Federal Aviation Regulations (FAR 135), FISMA, Federal Sentencing Guidelines, Food Safety Modernization Act (FSMA), Foreign Corrupt Practices Act (FCPA), Freedom of Information Act (FOIA), Gramm-Leach-Bliley Act (GLBA), HITECH, International Traffic in Arms Regulations (ITAR), Maritime Transportation Security Act (MTSA), Nuclear Security Standards, OSHA, Sarbanes-Oxley Act (SOX), SAFETY Act (DHS), Trafficking Victims Protection Act (TVPA). **Government Regulated Security Program Standards:** Director of Central Intelligence Directives (DCID), US DoD Directive 5200, US DoD Directive 5800, US DoD NISPROM / 32 CFR Part 117, Defense Federal Acquisition Regulation Supplement (DFARS), FISMA. **International Regulatory:** CSA Z246.1, Data Protection Act UK, EU Dangerous Preparations Directive, EU Data Protection Directive, EU GDPR, EU MiFID, Indonesian Chief of Police Regulation 24/2007, International Ship and Port Facility Security Code (ISPS), Maritime Transport & Offshore Facilities Security Act, PIPEDA, PTK 49, Ship and Port Facility (Security) Regulations UK, UK GDPR, Voluntary Principles on Security and Human Rights (VPSHR). **Non-Regulatory Guidelines / Standards:** Air Cargo Security Standard (TACSS-TAPA), API/ANSI RP 780, Facility Security Requirements (FSR-TAPA), GAISP, ISO 22300, ISO 27000, ISO 28000, JCAHO, NERC Standards, Payment Card Industry Data Security Standard (PCI DSS), Trucking Security Requirements (TSR-TAPA). These regulations and standards are a starting point to aid you in expanding your knowledge of growing responsibilities within the security profession. They also provide insight into business processes that have an impact on your organization. Understanding them will better position you to partner cross functionally as you align security programs in support of your company's current and future goals. There is a constant flow of new and changing regulatory obligations with built-in requirements to improve security and safety while reducing potential vulnerabilities. You must continuously stay up to date on these to ensure both your organization's compliance and the success of your security career.
Topic: career
By Jerry Brennan & Joanne Pollock, SMR Group