There are a variety of security compliance and regulatory frameworks that may apply to your organisation depending on elements such as its structure, services, policies or geography. Therefore, pinpointing and understanding your organisations specific compliance requirements – be they government mandates, industry watchdog recommendations or otherwise – is a vital step in your security mandate.
Again, many security compliance requirements are industry or service specific, but others can be broader. Examples include:
The Australian Government Information Security Manual (ISM) – focusses on the protection of information assets and ICT systems from cyber threats using effective risk management frameworks;
The Protective Security Policy Framework (PSPF) – assists Government entities by providing policy guidance and better practice advice for governance, physical, personnel and information security and may also apply to any non-government organisations that engage in business with government entities
The Identity and Access Management Standards (IAM) – made up of protocols that address the transfer of authentication information and the protection of data as it travels through networks or between servers
The International Organization for Standardization and the International Electrotechnical Commission ISO/IEC 27000 Series – these are international standards related to information security management
The Payment Card Industry Data Security Standard (PCI-DSS) – these are global standards designed for any organisation that accepts credit cards, as it helps to protect consumers’ financial information
It is important to remember that when it comes to security compliance, there is no one-size-fits all as each organisation will have different requirements that apply to them.