InfoSec, Inc. is a mainframe security company that helps clients comply with various cybersecurity standards and regulations. The document discusses several key compliance points that many IT managers find overwhelming including: Sarbanes-Oxley (SOX), which aims to improve financial disclosures from public companies; the Gramm-Leach-Bliley Act (GLBA), which protects private financial information; the Payment Card Industry Data Security Standard (PCI DSS), which protects payment card data; the Federal Information Security Management Act (FISMA), which strengthens information security in federal agencies; and the Health Insurance Portability and Accountability Act (HIPAA), which protects private health information. With so many compliance standards to follow

1. Mainframe Security:
Compliance Standards Can Be Overwhelming
INFOGRAPHIC
80%
14001-C St. Germain Dr. • Suite 809 • Centreville, VA 20121 • 703-825-1202 • www.infosecinc.com
InfoSec, Inc., a small business, is a premier mainframe services and software provider with services focused on IBM-RACF, CA-ACF2
and CA-Top Secret. We have been providing high-quality mainframe services and software since 1998, from operating system
installation, upgrade, performance and tuning, third-party software support and more on both the z/OS and VM/VSE platforms,
offering the finest available expertise for securing and supporting IBM z/OS and VM/VSE environments and for the IBM-RACF,
CA-Top Secret and CA-ACF2 security systems.
When it comes to mainframe data security and monitoring, the list of key
compliance points and standards is long and ever-growing. As the list grows over time,
many IT managers are left asking,
SARBANES-OXELY
Sarbanes-Oxely (SOX) is a federal law that sets new or expanded requirements for all U.S. public
company boards, management, public accounting firms, and privately held companies.
The average amount that a large
company in the U.S. spent on SOX
compliance in 2014
$1,000,000
Large companies typically spend
more than a year to become
completely SOX compliant
GRAMM-LEACH-BLILEY ACT
The Gramm-Leach-Bliley Act (GLBA) requires companies that offer consumers financial products
or services like loans, financial advice, or insurance to safeguard sensitive data and explain their
information sharing practices to their customers.
To be compliant you need to secure the following nonpublic personal information:
Name Address
SSN
Social Security Account Info
#$
Court Records
and more...
GLBA also requires that organizations provide easily understandable privacy statements to
consumers and offer them the option to opt-out of third-party data sharing.
PAYMENT CARD INDUSTRY DATA SECURITY STANDARD
The Payment Card Industry Data Security Standard (PICS DSS) is a set of standards set by major
payment card processing companies in partnership with the Better Business Bureau. It protects
consumers’ payment information while using credit or debit cards, or shopping with an
integrated payment app or on the web.
Businesses are categorized by the amount
of transactions they process in a year
Level 1
Level 2
Level 3
Level 4
< 20K 20K - 1M 1M - <6M 6M+
The average Level 1 merchant
will spend nearly
to obtain
PCI DSS compliance
$700,000
FEDERAL INFORMATION SECURITY MANAGEMENT ACT OF 2002
The Federal Information Security Management Act of 2002 (FISMA) assigns specific
responsibilities to federal agencies in order to strengthen information security systems. In
particular, FISMA requires the head of each agency to implement policies and procedures to
cost-effectively reduce information technology security risks to an acceptable level.
EMPLOYEE? HACKER?
!
HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT
The Health Insurance Portability and Accountability Act (HIPAA) requires health care providers
and organizations, as well as their associates, to develop and follow procedures that ensure the
confidentiality and security of Protected Health Information (PHI) when it is transferred,
received, handled, or shared.
The amount organizations in violation
of HIPAA may be fined per incident
$50,000
Health care records are worth 50x what credit
card numbers are on the black market
$
50
SOX
Compliance Standards Checklist
PCI HIPAAFISMAGLBA
of data breaches
come from within
the organization itself1
"Did I miss something?"
1 http://www.networkworld.com/article/2268110/lan-wan/chapter-1--understanding-network-security-principles.html