Independent Organizations

SCCE

www.corporatecompliance.org

SCCE exists to champion ethical practice and compliance standards in all organizations and to provide the necessary resources for compliance professionals and others who share these principles.

The Society of Corporate Compliance & Ethics (SCCE) is dedicated to improving the quality of corporate governance, compliance and ethics

OCEG

www.oceg.org

OCEG is a non-profit organization that has a straightforward , ambitious and timely mission: to help organizations align their governance. compliance and risk management activities to drive business performance and promote integrity.

GAO

www.gao.gov

The U.S. Government Accountability Office (GAO) is an independent, nonpartisan agency that works for Congress. Often called the "congressional watchdog," GAO investigates how the federal government spends taxpayer dollars.

ISACA

www.isaca.org

ISACA got its start in 1967, when a small group of individuals with similar jobs-auditing controls in the computer systems that were becoming increasingly critical to the operations of their organizations-sat down to discuss the need for a centralized source of information and guidance in the field. In 1969, the group formalized, incorporating as the EDP Auditors Association. In 1976 the association formed an education foundation to undertake large-scale research efforts to expand the knowledge and value of the IT governance and control field.

ITPolicyCompliance.com

www.itpolicycompliance.com

The ITpolicycompliance.com web site is dedicated to promoting the development of research and information that will help IT security professionals meet the policy and regulatory compliance goals of their organizations. Specifically, this site focuses on assisting organizations to improve compliance results by providing reports based on primary research as well as other related information and resources.

Government Regulators

WDPA

World Data Protection Authorities

Links to Government authorities that implement and monitor local and regional data protection and privacy regulations.

Bank for International Settlements

GASB
Government Accounting Standards Board
The GASB establishes and improves standards of state and local government accounting and financial reporting.

Federal Reserve

FASB
Financial Accounting Standards Board
The Financial Accounting Standards Board (FASB) is the designated organization in the private sector in the United States for establishing standards of financial accounting and reporting.

FERC
U.S. Federal Energy Regulatory Commission
The Federal Energy Regulatory Commission, or FERC, is an independent agency that regulates the interstate transmission of electricity, natural gas, and oil.

FinCEN Financial Crimes Enforcement Network
The U.S. Department of the Treasury established the Financial Crimes Enforcement Network in 1990 to provide a government-wide multisource financial intelligence and analysis network. The organization's operation was broadened in 1994 to include regulatory responsibilities for administering the Bank Secrecy Act, one of the nation's most potent weapons for preventing corruption of the U.S. financial system.

FISMA
Federal Information Security Management Act
The Federal Information Security Management Act is designed to protect critical information infrastructure.

Board of Governors of the Federal Reserve System

Industry Associations

AAA
American Accounting Association

The American Accounting Association promotes worldwide accounting education, research and practice. The Association is a voluntary organization of persons interested in accounting education and research.

ABA
American Bankers Association - Center for Regulatory Compliance

ABA's Center for Regulatory Compliance is a gateway to support for meeting the challenges of managing compliance risk. It provides direct access to regulatory expertise, up-to-date reports on agency initiatives, and the resources to assist organizations in keeping pace with the demands of supervisory oversight.

AGA
Association of Government Accountants

The Association of Government Accountants is dedicated to the enhancement of public financial management. AGA serves the professional interests of financial managers, from local, state and federal governments, as well as public accounting firms, responsible for effectively using billions of dollars and other monetary resources every day.

AICPA
American Institute of Certified Public Accountants

The American Institute of Certified Public Accountants is a U.S. professional organization for Certified Public Accountants. Its mission is to provide members with the resources, information, and leadership that enable them to provide valuable services in the highest professional manner to benefit the public as well as employers and clients.

Basel II CPA
Basel II Compliance Professionals Association

Basel II is the second Basel Accord. It contains recommendations by bank supervisors and central bankers from the 13 countries making up the Basel Committee on Banking Supervision to revise the international standards for measuring the adequacy of a bank's capital. It was created to promote greater consistency in the way banks and banking regulators approach risk management across national borders.

COSO
Committee of Sponsoring Organizations of the Treadway Commission

COSO is an independent private sector initiative which studies the causal factors that can lead to fraudulent financial reporting and develops recommendations for public companies and their independent auditors, for the SEC and other regulators, and for educational institutions.

CSI
Computer Security Institute

The Computer Security Institute (CSI) is a membership organization specifically dedicated to serving and training the information, computer and network security professional. CSI delivers education and aggressively advocates the critical importance of protecting information assets. CSI sponsors two conferences annually, targeted at those entering the field, as well as to experienced practioners. CSI also publishes the annual CSI/FBI Computer Crime and Security Survey.

FASB
Financial Accounting Standards Board

The Financial Accounting Standards Board is the designated organization in the U.S. for establishing standards of financial accounting and reporting. Those standards govern the preparation of financial reports and are officially recognized as authoritative by the Securities and Exchange Commission and the American Institute of Certified Public Accountants. The standards are considered essential to the efficient functioning of the economy because investors, creditors, auditors, and others rely on credible, transparent and comparable financial information.

FEI
Financial Executives International

Financial Executives International (FEI) is an advocate for the views of corporate financial management. Its 15,000 members hold policy-making positions as chief financial officers, treasurers, and controllers. FEI enhances member professional development through peer networking, career planning services, conferences, publications, and special reports and research. Members participate in the activities of 86 chapters, 75 of which are in the United States and 11 in Canada.

Policy Standards and Frameworks

CIS
Center for Internet Security
The Center for Internet Security (CIS) is a non-profit enterprise whose mission is to help organizations reduce the risk of business and e-commerce disruptions resulting from inadequate technical security controls. CIS members develop and encourage the widespread use of security configuration benchmarks through a global consensus process involving participants from the public and private sectors.

COBiT 
more information>

CobIT is an IT governance framework and supporting toolset that allows managers to bridge the gap between control requirements, technical issues and business risks. COBIT enables clear policy development and practices for IT control throughout organizations.

GAGAS

more information

Government Auditing Standards (the "Yellow Book") contains standards for audits of government organizations, programs, activities, and functions, and of government assistance received by contractors, nonprofit organizations, and other nongovernment organizations.

Guide to Assessment of IT General Controls Scope based on Risk (GAIT)
more information>
The IIA's GAIT, focused principally on Sarbanes Oxley, provides guidance to appropriately identify and link COSO constructs of internal control objectives, with assertions, risks and controls, to enable audit and IT practitioners to reach well informed decisions on which controls to include and exclude.

Global Technology Audit Guide (GTAG)
more information>
Written for he chief audit executive, The IIA's GTAG publications provide guidance on information technology.  Each guide addresses timely issues related to IT management, control or security. 

ISO 17799
more information>

ISO is the developer of International Standards specifying requirements for state-of-the-art products, services, processes, materials and systems.  ISO 17999 is focused on controls and practices for information security. Also visit the ISO 17799 Directory at http://www.27002.net/ (see ISO 27000)

ISO 27000 and ISO 27001
The ISO 27000 series of standards promise to cover a larger body of practice.  Under way, these developments can be found at http://www.w3j.com/5/index.html.  Information on ISO 27001 can be found at http://www.27001-online.com

ITIL
More information
IT Service Management standards from the Office of Government Commerce are focused on the strategic business value delivered by IT through high quality service.

NIST resources: Computer Security Resource Center
NIST resources: Rainbow Series
NIST's Computer Security Division conducts research, studies and advises agencies of IT vulnerabilities and devising techniques for the cost-effective security and privacy of sensitive Federal systems.  NIST also develops standards, metrics, tests and validation programs and has long published guidance about secure IT development, usage, planning, implementation, management and operation.

This article or section deals primarily with the United States and does not present a worldwide view of the subject.

Continuity of Government (COG) is the principle of establishing defined procedures that allow a government to continue its essential operations in case of a nuclear war or other catastrophic event. Developed during the Cold War, COG plans were implemented by many countries to avoid leaving a vacuum at any governmental level, which could lead to anarchy or to an unlawful assumption of authority. Effectively the democratic process is revoked temporarily until the effects of the event have subsided and normal government can resume. It is not a generally published part of government policy and is generally shrouded in secrecy for security reasons.

Continuity of Government in the United States
The main points of such a plan in the United States are to suspend certain parts of the United States Constitution and to allow the alternative use of federal land and buildings (including use as internment camps) by FEMA for the housing/detention of US citizens as required, as well as any rescue/recovery operations. It also allows for power in the US to be centralized to the White House and "appointment of military commanders to run state and local governments and declaration of martial law". In the former regard the United States arrangements for Continuity of Government are unusual. The plans in most countries are intended to preserve the legal and constitutional framework, the American system relies on circumventing it. There is no legal basis for the imposition of so-called "martial law".

House Democrat Jack Brooks brought up the issue during the Iran-Contra Affair hearings. Try as he might, he was not able to get the answers to his questions from Col. Oliver North, (it had been reported in the Miami Herald that North had worked on such plans) as he was repeatedly requested by the Chairman to refrain from discussing the issue and to request for a (non-public) executive session if he wanted to discuss the issue at all.

Apparently the Legislative and Judiciary Branches pf the US Government each have similar continuity plans. However, both require the Executive to notify them before they are activated. There appears to have been no notification following 9-11 to either the Congress or US Supreme Court until it was finally admitted to Congress in 2002.

The Federal Information Security Management Act of 2002 ("FISMA", 44 U.S.C. § 3541, et seq.) is a United States federal law enacted in 2002 as Title III of the E-Government Act of 2002 (Pub.L. 107-347, 116 Stat. 2899). The Act was meant to bolster computer and network security within the Federal Government and affiliated parties (such as government contractors) by mandating yearly audits.

FISMA has brought attention to cybersecurity within the Federal Government, which had previously been much neglected. As of February 2005, many government agencies received extremely poor marks on the official report card, with an average of 67.3% for 2004, an improvement of only 2.3 percentage points over 2003.This shows a marginal increase in how federal agencies prioritize cybersecurity, but experts warn that this average must increase for the Government to truly protect itself.

FISMA Compliance Process for an Information System
FISMA imposes a mandatory set of processes that must be followed for all information systems used or operated by a US Government federal agency or by a contractor or other organization on behalf of a US Government agency. These processes must follow a combination of Federal Information Processing standards (FIPS) documents, the special publications SP-800 series issued by NIST, and other legislation pertinent to federal information systems, such as the Privacy Act of 1974 and the Health Insurance Portability and Accountability Act.

Determination of Boundaries of System
The first step is determining what constitutes an "information system." There is not a direct mapping of computers to information system; rather an information system can be a collection of individual computers put to a common purpose and managed by the same system owner. NIST SP 800-18 provides guidance on determining system boundaries.

Determination and Categorization of Information Types in System
The next step is to determine the information types resident in the system and categorize each according to the magnitude of harm resulting were the system to suffer a compromise of Confidentiality, Integrity, or Availability. NIST SP 800-60 provides a catalog of information types, and FIPS-199 provides a rating methodology and a definition of the three criteria. The overall FIPS-199 system categorization is the high water mark of the impact rating of all the criteria of all information types resident in the system.

Select and Implement a Set of Security Controls for System
If the system in question is in the design or implementation life-cycle phase, a set of security controls must be selected and incorporated into the system implementation. NIST SP 800-53 provides a catalog of

Documenting System
Pertinent system information such as system boundaries, information types, constituent components, responsible individuals, description of user communities, interconnections with other systems and implementation details for each security control need to be documented in the system security plan. NIST SP 800-18 Rev 1 gives guidance on documentation standards. Additional documentation such as a contingency plan for the system also needs to be prepared at this stage. Guidance on contingency planning can be found in NIST SP 800-34.

The United States Occupational Safety and Health Administration (OSHA) is an agency of the United States Department of Labor. It was created by Congress under the Occupational Safety and Health Act, signed by President Richard M. Nixon, on December 29, 1970. Its mission is to prevent work-related injuries, illnesses, and deaths by issuing and enforcing rules (called standards) for workplace safety and health.

OSHA Authority
OSHA's statutory authority extends to most nongovernmental workplaces where there are employees. State and local government workers are excluded from Federal coverage, however, states operating their own state workplace safety and health programs under plans approved by the U.S. Department of Labor cover most private sector workers and are also required to extend their coverage to public sector (state and local government) workers in the state. Section 2 (11) of the OSH Act encourages states to develop and operate their own state OSH programs.

The same act (OSHA) also created the National Institute for Occupational Safety and Health (NIOSH) as a research agency whose purpose is to determine the major types of hazards in the workplace and ways of controlling them. As of March 2006, the agency is headed by Assistant Secretary of Labor Edwin Foulke.

OSHA regulations [29 CFR Part 1956] also permit states without approved plans to develop plans that cover only public sector workers. In these states, private sector employment remains under Federal OSHA jurisdiction. Twenty-two states and territories operate plans covering both the public and private sectors and four states - Connecticut, New Jersey, New York and the US Virgin Islands - operate public employee only plans.

History
OSHA was widely criticized in its early years for confusing, burdensome regulations. A good deal of the early conflict came about because of arbitrary and inconsistent enforcement during OSHA's early years. In addition, businesses were expected to retrofit guards and other safety devices on existing equipment and to implement other hazard controls, often at considerable expense, to bring them in line with then-current best safety practices. Other requirements, such as mandated training, communication, and extensive documentation were seen as even more difficult and expensive.

With time, manufacturers of industrial equipment have included OSHA-compliant safety features on new machinery. Enforcement has become more consistent across jurisdictions, and some of the more outdated or irrelevant rules have been repealed or are not enforced.

During the Jimmy Carter administration, under the leadership of University of Cincinnati toxicologist Eula Bingham, OSHA began to concentrate more on health hazards, such as toxic chemicals. Bingham also launched the "New Directions" program, OSHA's first worker training grant program.

With the Ronald Reagan and George H.W. Bush administrations came efforts to weaken OSHA enforcement and rulemaking, although several important rules were issued including hazard communication (right to know about chemical exposures) and blood-borne pathogens (to protect workers against illnesses such as hepatitis and AIDS). The Reagan administration also launched OSHA's Voluntary Protection Program (VPP), OSHA's first foray into voluntary programs and partnerships with industry. In the VPP, management, labor, and OSHA establish cooperative relationships at workplaces that have implemented a comprehensive safety and health management system. Approval into VPP is OSHA's official recognition of the outstanding efforts of employers and employees who have achieved exemplary occupational safety and health.

The Bill Clinton administration began a reorganization of OSHA's approach, focusing more on "stakeholder" satisfaction through compliance assistance. When the Republicans took over Congress in 1994, one of their goals was reducing some of the agency's ability to issue standards. Some Republican sponsored bills were stopped by the Democratic minority and moderate Republicans, but other legislation passed, such as the Small Business Regulatory Enforcement Fairness Act of 1996 and the Congressional Review Act.

In 2000, OSHA issued the ergonomics standard after ten years of study and struggles with a Republican-controlled Congress and business associations such as the Chamber of Commerce and National Association of Manufacturers that were unconvinced that additional government regulation was the right way to address the issue of ergonomic injuries to American workers. Ergonomic injuries (also known as musculoskeletal injuries) such as back injuries and carpal tunnel syndrome, account for 1/3 of all serious injuries suffered by American workers. In March 2001, the Republican controlled Congress voted to repeal the standard and the repeal was one of the first major pieces of legislation signed by President George W. Bush. Since the repeal of the ergonomics standard, OSHA has issued three ergonomics guidelines, and only a small handful of ergonomic citations under the Act's "general duty" clause.