No cryptography algorithms shall be used unless the patent has either expired or the company maintains a valid license. License arrangement must meet the expected use of the product or service life as well as comply with export control guidelines

Travel by employees to countries that do not extend personal use exemptions will require authorization by the legal department and the filing of an encryption import license

Software or hardware products containing an encryption level higher than 512-bit key encryption will not be sent or used outside of the US.

Personal healthcare information (PHI) of employees or customers, regardless of the Health Insurance Portability and Accountability Act (HIPAA) compliance requirements, will be encrypted with an algorithm and processes prescribed by the company’s PHI risk assessment

In the event travel or equipment deployment is required within an import restricted country, an appropriate license will be filed, and only after US Department of State approval will the activity proceed.

Data sent to and stored in foreign countries will comply with all local encryption laws. If local encryption law requires a lower level of key length than currently used, an application for an export license will be necessary.

Employees traveling to countries that require key disclosure will abide by all local encryption laws including providing the password to decrypt information requested by local authorities. Any time a request is made the employee will immediately notify the legal department

Encryption of personal data at a level meeting or exceeding the highest-level key length of any state will be followed to ensure compliance with all state safe harbor provisions.

Applications or systems that interact with minors (13 and under) will comply with the standards of the Internet Keep Safe Coalition (iKeepSafe) and its Safe Harbor program under the Children’s Online Privacy Protection Act (COPPA).

A current library of state, federal, and international privacy laws will be maintained. A cross-mapping of security controls with legal requirements will be maintained to ensure alignment with the cybersecurity program.

Applications or systems that interact with minors (17 and under) will abide by all provisions of any state’s child privacy law including prohibiting the sale of dangerous products and complying with requests to remove personal data

Digital evidence will be gathered according to the Federal Rules of Evidence under the oversight of the legal department

To ensure evidence in a cybercrime investigation is admissible in a court of law, all evidence will be gathered according to the US Department of Justice’s Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations manual under the oversight of the legal department.

In the event of a pending lawsuit or issuance of a preservation order, no employee or contractor will destroy or alter in any way the data identified by the court order.

No action will be taken unless and until the direct oversight of the legal department has begun. All documents requested will be secured in a manner as to preserve them for plaintiff discovery.

If a discovery order is received to produce information, full cooperation will be provided to the plaintiff’s legal counsel and the data will be decrypted and submitted. This process can only occur under the direction of legal counsel.

The company will carry a cyber liability insurance policy for up to $5 million above the self-insurance loss pool of $1 million with a $100,000 per loss deductible for third party losses.

An annual assessment of cyber liability coverage will be performed considering the estimated loss exposure for a data breach based on the projected number of compromised records in the next physical year.

Is a technology used to track websites and stream updates to a data repository, such as a spreadsheet or database. This makes keeping up with changes in the law more efficient.

Policy scanners are available as a cloud-based service, meaning they're operated by 3rd parties, and as standalone products in which users can use first-hand.

When conducting data breach investigations, your organization will require a __________ to either identify evidence destroyed by employees or create evidence according to the best evidence rule.

This type of insurance covers non-fraudulent causes of failures or errors occurring in the performance of computer services. Technology companies offering cloud, software, or consulting services typically acquire this type of insurance.

This type of insurance covers customer injury claims resulting from intellectual property infringement, copyright or trademark infringement, libel, and slander. Coverage could also be extended to patents or trade secret violations. This coverage is important to organizations with sizable online presences.

This type of insurance covers network equipment failures or external attacks against your network including denial of service attacks. Network outages or breaches covered can include data breaches of consumer information, cyber extortion, data alteration or destruction, or malware infestations.

This type of insurance covers breach of physical records caused by theft, loss, or accidental disclosure. Other incidents that may be covered include improper disposal of equipment containing sensitive data and inadvertently collecting confidential information

This type of insurance is a hybrid policy that also provides coverage for both the insured company and their third-party service providers. It covers the costs for responding to and recovering from data breaches, including penalties assessed from a lawsuit.

Is an amount of insurance coverage available to cover a specific type of loss.

The risk that is left after you have applied all your security control

Compliance with legal and regulatory standards and statutes is a prime focus of many external audit organizations today.

Verifying the financial statements and risk to the organization is the main focus of external auditors