Welcome to the World of Rules and Roadmaps!

Hello, future CPA! Welcome to one of the most important chapters in the Information Systems and Controls (ISC) section. In this chapter, we are exploring Regulations, Standards, and Frameworks.

If you have ever felt overwhelmed by all the "alphabet soup" in IT (like NIST, HIPAA, and GDPR), don't worry! Think of this chapter as learning the rules of the road. Just as traffic laws keep drivers safe, these regulations and frameworks keep data safe. By the end of these notes, you will understand how organizations stay legal and secure.

1. Why Do We Need These Rules?

Before we dive into the specific names, let’s understand the "why." Organizations don't just protect data because they are "nice." They do it because:
1. Laws (Regulations): Governments force them to (or they face huge fines).
2. Trust (Standards): Customers only give data to companies they trust.
3. Efficiency (Frameworks): It’s easier to follow a pre-made "blueprint" than to guess how to be secure.

Quick Review: Regulations are mandatory (must do), while frameworks are voluntary guides (should do) that help you meet the regulations.

2. Key Regulations: The "Must-Follow" Laws

In the US CPA exam, you need to know which law applies to which industry. Let’s break down the big ones.

A. HIPAA (Health Insurance Portability and Accountability Act)

PII is information that identifies or can be linked to an individual. HIPAA PHI is individually identifiable health information maintained or transmitted by a covered entity or business associate, subject to statutory exclusions (including certain employment and education records). Health-related data is not automatically HIPAA PHI merely because it concerns a person.

B. GLBA (Gramm-Leach-Bliley Act)

Focus: Financial institutions.
GLBA requires banks and insurance companies to explain how they share customer data and keep that data safe. It protects Non-Public Personal Information (NPI).
Memory Aid: Think of the "B" in GLBA for Banks.

C. Privacy Laws (GDPR and CCPA)

GDPR scope depends on EU establishment or specified offering of goods/services to, or monitoring of, people in the EU—not simply citizenship. It includes several rights and obligations, not just erasure, and rights have conditions and exceptions. CCPA as amended by CPRA gives covered California consumers rights including access/knowledge, deletion, correction, opting out of sale/sharing and limiting certain uses of sensitive information, subject to applicability and exceptions. It is not accurately described as merely “GDPR-lite.”

Key Takeaway: If the question mentions "Patients," think HIPAA. If it mentions "Banks," think GLBA. If it mentions "Consumer Rights," think Privacy Laws.

3. Security Frameworks: The "Blueprints"

A framework is like a checklist. It helps a company organize its security so nothing gets missed. Don't worry if these seem dry—they are just organized lists of "good ideas."

A. NIST Cybersecurity Framework (CSF)

NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern establishes strategy, responsibilities, policy and oversight across the other functions. The five-function list describes CSF 1.1, not the complete current framework. Frameworks may be voluntary in general but become mandatory through an applicable law, regulator or contract.

B. COBIT (Control Objectives for Information and Related Technologies)

Focus: Governance and Management.
COBIT is created by ISACA. It’s less about "how to set a password" and more about "how the Board of Directors should oversee IT." It bridges the gap between business goals and IT goals.

C. ISO/IEC 27001

Focus: International Standards.
If a company wants to prove to the whole world they are secure, they get an ISO 27001 certification. It’s like an "A+" grade from an international teacher.

Quick Review: NIST is the practical US blueprint. COBIT is for high-level management. ISO is for international certification.

4. SOC Reporting: The Trust Builder

As a CPA, you will hear a lot about SOC (System and Organization Controls) reports. For Area II (Security, Confidentiality, and Privacy), SOC 2 is the star of the show.

The five TSC categories are Security, Availability, Processing Integrity, Confidentiality and Privacy. Relevant common criteria apply across the selected categories. Confidentiality protects information designated confidential, including business secrets AND personal information. Privacy governs personal information throughout collection, use, retention, disclosure and disposal in line with applicable commitments and requirements. These categories overlap: a customer’s account information can be both confidential and subject to privacy controls.

Did you know? A Type I report looks at the design of controls on a specific date. A Type II report looks at how well those controls worked over a period of time (usually 6 months). Type II is much more valuable!

5. Common Mistakes to Avoid

Confidentiality protects information designated confidential, including business secrets AND personal information. Privacy governs personal information throughout collection, use, retention, disclosure and disposal in line with applicable commitments and requirements. These categories overlap: a customer’s account information can be both confidential and subject to privacy controls.

NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern establishes strategy, responsibilities, policy and oversight across the other functions. The five-function list describes CSF 1.1, not the complete current framework. Frameworks may be voluntary in general but become mandatory through an applicable law, regulator or contract.

6. Summary Table for Quick Study

NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern establishes strategy, responsibilities, policy and oversight across the other functions. The five-function list describes CSF 1.1, not the complete current framework. Frameworks may be voluntary in general but become mandatory through an applicable law, regulator or contract.

Key Takeaway for the Exam:

The CPA exam wants to ensure you can identify which set of rules applies to a specific scenario. When reading a question, look for keywords like "Medical," "Bank," "Governance," or "International." Those keywords are your map to the right answer!

Don't worry if this seems like a lot of names to memorize at first. Just keep thinking about the intent behind the rule—usually, it's just about keeping the wrong people away from sensitive data!