Category: Regulations

The SEC and PCAOB arranged the roundtable to solicit feedback about Section 404 of the legislation, which requires companies to attest to the effectiveness of internal controls put in place to protect financial reporting systems and processes. “In practice it hasn’t always worked out that way,” he acknowledged.

Over the course of five panel discussions, participants shared their experiences with the internal control reporting requirements.

http://www.networkworld.com/news/2006/051106-sox-costs.html

“Victims are protected by federal law from having to pay the fraudulent charges, so the loss is primarily of time,” says Beth Givens, founder of the nonprofit Privacy Rights Clearinghouse.

Attorneys at the FTC are still working out exactly which losses will be covered.

One qualified expense: the cost of credit monitoring for victims who discovered the fraud before ChoicePoint notified them of the breach and offered free credit monitoring.

http://www.csoonline.com/read/040106/penalty.html

One bill, sponsored by Massachusetts Democrat Edward Markey, would require the FTC to make new rules limiting the sale and purchase of those identifiers, with exceptions for law enforcement, public health, certain emergency situations and selected research projects.

Another measure, sponsored by Florida Republican Clay Shaw, would restrict the display of SSNs on credit reports and on various government-issued documents and identification tags.

Several federal laws, including the Fair Credit Reporting Act and the Health Insurance Portability and Accountability Act, better known as HIPAA, also include restrictions on use and disclosure of the identifiers.

http://news.com.com/Congress+may+slap+restrictions+on+SSN+use/2100-7348_3-6071441.html?tag=nefd.top

The bills differ in several ways, including varying requirements about when a breached company should notify customers and whether consumers should be able to freeze their credit reports following a breach. Beyond the confusion about the differences in the bills, five congressional committees have claimed jurisdiction over some of the data breach bills.

Two data breach notification bills have passed through Senate committees and are awaiting action on the Senate floor, and two other bills are awaiting action on the House floor.

Dianne Feinstein, a California Democrat and early advocate for a national data breach notification law, said he’s still hopeful a law will get through Congress this year, but others are less optimistic.

Both the House and the Senate have targeted Oct. 6 to adjourn for the year, giving lawmakers about a month to campaign for the November general elections.

http://www2.csoonline.com/blog_view.html?CID=20859

Guidelines for this directive include:
· There should be an incentive for providers to contribute to the overall security of interconnected networks rather than protecting merely their own resources.
· Providers need to be more proactive and monitor their networks for risks of security breaches. Providers could also be asked to report which networks they monitor.
· This includes guidance to consumers as well as guidance to the provider’s staff, in particular with regard to incident response and emergency planning.
· The need for contact details for email abuse and security violations should also be stressed.

Providers in Europe are more concerned about spam emails that their customers receive than they are concerned with spam that their customers send.

http://www.enisa.eu.int/doc/pdf/deliverables/enisa_security_spam.pdf

The record indicates that TTPs are available to provide a variety of services for CALEA compliance to carriers, including processing requests for intercepts, conducting electronic surveillance, and delivering relevant information to LEAs. Fifth, the Order restricts the availability of compliance extensions under CALEA section 107(c) to equipment, facilities and services deployed prior to October 25, 1998 and clarifies the role and scope of CALEA section 109(b), under which carriers may be reimbursed for their CALEA compliance costs. Seventh, the Order concludes that carriers are responsible for CALEA development and implementation costs for post-January 1, 1995 equipment and facilities, and declines to adopt a national surcharge to recover CALEA costs. -FCC-

http://www.itu.int/osg/spu/newslog/FCC+Adopts+Order+To+Enable+Law+Enforcement+Access+To+Broadband+And+VoIP+Providers.aspx