Microsoft System Center Process Pack for IT GRC Release Notes
Published: April 2012 
© 2012 Microsoft Corporation. All rights reserved.

Contents
§1. Brief Description of the Process Pack for IT GRC
§2. Getting Started
§3. Known Issues
§4. Feedback
§5. Disclaimer
§6. Copyright and License Agreement
§7. Supported Authority Documents

§1. Brief Description of the Process Pack for IT GRC
The Microsoft System Center Process Pack for IT GRC (“Process Pack for IT GRC”) is a Process Pack for Microsoft® System Center Service Manager 2012 that helps automate end-to-end compliance management. The included IT Compliance Management Library contains compliance information that can take advantage of System Center Service Manager’s integration with System Center Configuration Manager to monitor, validate, and report on the compliance state of deployed Microsoft products. Together, these solutions help Microsoft customers understand and bind complex business objectives to their computing infrastructure.
§2. Getting Started
See the Process Pack for IT GRC – Evaluation and Deployment Guide.

§3. Known Issues
The following are known functional issues for this release:
•	Process Pack for IT GRC cannot be uninstalled if Service Manager is uninstalled first. The correct order to uninstall the Process Pack for IT GRC for Service Manager is to first uninstall the Process Pack for IT GRC for Service Manager from default programs in Control Panel and then to uninstall Service Manager.
•	Windows Server 2003 and Windows XP did not correlate Service Pack information with Service Pack build numbers. Please check the results carefully when using DCM (Desired Configuration Management) to check Windows Server 2003 and Windows XP Service Packs; unknown results might display in the SQL Server Reporting service report.
•	Test criteria that are greater than 4000 characters cannot be processed by the Service Manager Console, and can cause it to shut down unexpectedly. A small number of test criteria in this release were initially greater than 4000 characters; these test criteria were truncated in this release to prevent unexpected shutdowns.
•	After the Process Pack for IT GRC add-in successfully installs, an error message may display that indicates Setup has stopped working.
•	Adding related items can only be possible for instances of compliance objects and not to any templates.
•	To add an item under a category or a control objective in the program framework you have to expand the node, or else the added item would not display.
•	Modifying the compliance applicability groups provided in IT Compliance Management Libraries using the Service Manager Console causes the Service Manager console to abnormally terminate or become unresponsive. (9/30/2010)
•	Modifying a program’s General and Framework tabs at the same time may result in a data conflict error message. To resolve this issue, modify each tab separately and apply the changes separately. (9/30/2010)
•	After modifying an existing security role property, such as description, a user who is assigned that security role may not be able to select authorized configuration item types such as Computer, Software Items, and Business Services that were previously available. (9/30/2010)
•	The IT GRC Connector may not complete processing or hang. To resolve this issue, delete the connector instance and recreate it. (9/30/2010)
•	The Visual Studio Tools for Office (VSTO) version 3.0 (used by Microsoft Excel® in the IT GRC Process Pack Client Add-in) does not support 64-bit versions of Microsoft Office System 2010. However, 32-bit versions of Microsoft Office System 2007 and 2010 are supported. (2/2011)
•	When a Program Implementer tries to add scope to a program, they may see the following error “An item with the same key has already been added." The message is misleading because it is a security issue and the PI role cannot add scope to a program. (2/2011)
•	The SP1 version of the IT GRC Excel Client can only be used to connect to an SP1 server. The 1.0 version of the Excel Client Add-in can connect to both a v1.0 server and a SP1 server. (2/2011)
•	If an unshared risk is created and added into a program, the risk will only be visible to the risk’s owner and not visible to the Program Manager. If the risk is added to a category in the program framework, the risk will be visible to Program Manager. (2/2011)
•	Although it is possible to customize both the Risk Management form and the Control Objective form using the Authoring Tool, the customizations will not display. All other forms should work properly after customization. (2/2011)
•	Row deletions in Excel are not allowed. (2/2011)

The following are known performance issues for this release:
•	Importing a large number of control objectives and control activities into a program using the Control Import Wizard can take a considerable amount of time. (9/30/10)
•	Refreshing or publishing a program in the IT GRC Process Pack Client Add-in that is used in Microsoft Excel can take a considerable amount of time if the program contains a large number of control objectives, control activities, or risks. (9/30/10)
•	Expanding information on the Framework tab of a program can take a considerable amount of time if the program contains a large number of control objectives, control activities, or risks. (9/30/10)

§4. Feedback
Send suggestions and comments about this document to secwish@microsoft.com.

§5. Disclaimer
IMPORTANT INFORMATION: The Microsoft System Center Process Pack for IT GRC (“Process Pack for IT GRC”) is designed to facilitate compliance activities conducted by your organization’s IT experts, auditors, accountants, attorneys and other compliance professionals. The software does not replace those professionals. The Process Pack for IT GRC includes some control objectives and authority document citations plus libraries with some control activities and associated product value settings. These objectives, citations, controls and settings do not verify or guarantee fulfillment of your organization’s compliance obligations. It is the responsibility of your organization to choose the objectives, citations, controls and settings to use, modify, add or remove based on guidance from your organization’s compliance professionals. Reports and any other information provided by or generated from the software do not constitute professional compliance advice. You must consult compliance professionals to confirm compliance with specific governance, risk, and compliance authority documents.

§6. Copyright and License Agreement
This document is provided "as-is". Information and views expressed in this document, including URL and other Internet Web site references, may change without notice. You bear the risk of using it.

Some examples depicted herein are provided for illustration only and are fictitious. No real association or connection is intended or should be inferred.

This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes. You may modify this document for your internal, reference purposes.

© 2012 Microsoft Corporation. All rights reserved.

Microsoft and Excel are trademarks of the Microsoft group of companies. 

All other trademarks are property of their respective owners.

§7. Supported Authority Documents
Below is a full list of all supported authority documents for Process Pack for IT GRC release. 
Some authority documents cited in v1.0 and SP1 release are no longer supported in the current Process Pack for IT GRC release, as they have been deprecated.
Each of these documents is cited at the authority document level, except the following 12 are mapped to section-level citation: 
•	OGC ITIL: Security Management
•	MOF Service Management Function
•	The Sarbanes-Oxley Act of 2002 (SOX)
•	Payment Card Industry (PCI) Data Security Standard 2.0, Requirements and Security Assessment Procedures
•	Guide for Assessing the Security Controls in Federal Information Systems,  NIST SP 800-53A
•	ISO/IEC 27002 Code of practice for information security management
•	ISO/IEC 27001 Information Security Management Systems - Requirements
•	Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, 104th Congress
•	Federal Information Security Management Act
•	Federal Risk and Authorization Management Program
•	The Cloud Security Alliance Controls Matrix
•	CobiT

#	TITLE	URL LINK	
1	§ 1724 California Civil Code	http://www.leginfo.ca.gov/pub/07-08/bill/asm/ab_0751-0800/ab_779_bill_20070410_amended_asm_v98.pdf	
2	NRC Regulations (10 CFR) § 73.54 Protection of digital computer and communication systems and networks	http://www.nrc.gov/reading-rm/doc-collections/cfr/part073/part073-0054.html	
3	EFT (Electronic Fund Transfer) Act (Reg. E) SEC 12 CFR 205	http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&amp;sid=635f26c4af3e2fe4327fd25ef4cb5638&amp;tpl=/ecfrbrowse/Title12/12cfr205_main_02.tpl	
4	SEC 12 CFR 229 Availability of Funds and Collection (Check Clearing for the 21st Century)	http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&amp;sid=91f3f63db5cf1624698533e65e823221&amp;rgn=div5&amp;view=text&amp;node=12:3.0.1.1.10&amp;idno=12#12:3.0.1.1.10.4.8.11.30	
5	NCUA Guidelines for Safeguarding Member Information, 12 CFR 748	http://www.ffiec.gov/exam/InfoBase/documents/02-ncu-12_cfr_748_app_a_safeguard_info-010100.pdf	
6	Amendments to the FTC Telemarketing Sales Rule, 16 CFR Part 310	http://www.ftc.gov/bcp/rulemaking/tsr/	
7	Telemarketing Sales Rule (TSR), 16 CFR 310	http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&amp;sid=bf60e7b87681ffcbf1030185f246d305&amp;rgn=div5&amp;view=text&amp;node=16:1.0.1.3.34&amp;idno=16	
8	Children's Online Privacy Protection Act (COPPA), 16 CFR 312	http://www.gpo.gov/nara/cfr/waisidx_03/16cfr312_03.html	
9	Privacy of Consumer Financial Information, FTC 16 CFR 313	http://www.ftc.gov/os/2000/05/65fr33645.pdf	
10	Standards for Safeguarding Customer Information; Final Rule, FTC 16 CFR 314	http://www.ftc.gov/os/2002/05/67fr36585.pdf	
11	16 CFR Part 682 Disposal of consumer report information and records	http://www.access.gpo.gov/nara/cfr/waisidx_05/16cfr682_05.html	
12	Retention of Audit and Review Records, SEC 17 CFR 210.2-06	http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&amp;sid=1e057afa900af722d0a59a28773472ed&amp;rgn=div8&amp;view=text&amp;node=17:2.0.1.1.8.0.18.9&amp;idno=17	
13	Controls and Procedures, SEC 17 CFR 240.15d-15	http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr;sid=c446d97494e9cd1d9bd0f1c628456f00;rgn=div8;view=text;node=17%3A3.0.1.1.1.2.87.310;idno=17;cc=ecfr	
14	Reporting Transactions and Holdings, SEC 17 CFR 240.16a-3	http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr;sid=3fc1d2e7d4a2c838ca758408923105a8;rgn=div8;view=text;node=17%3A3.0.1.1.1.2.90.348;idno=17;cc=ecfr	
15	Recordkeeping rule for securities exchanges, SEC 17 CFR 240.17a-1	http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr;sid=8a707a87faf38f7d2846d9b026ef323e;rgn=div8;view=text;node=17%3A3.0.1.1.1.2.94.371;idno=17;cc=ecfr	
16	Records to be made by certain exchange members, brokers, and dealers SEC 17 CFR 240.17a-3	http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr;sid=45bcefcbca5a2961e1cee9a9cb01b160;rgn=div8;view=text;node=17%3A3.0.1.1.1.2.94.373;idno=17;cc=ecfr	
17	Records to be preserved by certain exchange members, brokers, and dealers SEC 17 CFR 240.17a-4	http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr;sid=90722b0e4f8ff362197b60c394489ce4;rgn=div8;view=text;node=17%3A3.0.1.1.1.2.94.375;idno=17;cc=ecfr	
18	Record retention SEC 17 CFR 240.17Ad-7	http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr;sid=c81f9f1046cb6bc1569a5db1ff1cb3ca;rgn=div8;view=text;node=17%3A3.0.1.1.1.2.97.421;idno=17;cc=ecfr	
19	Part II Securities and Exchange Commission 17 CFR Parts 210, 228, 229 and 240 Amendments to Rules Regarding Management's Report on Internal Control Over Financial Reporting; Final Rule	http://www.sec.gov/rules/final/2007/33-8809fr.pdf	
20	Driver's Privacy Protection Act (DPPA), 18 USC 2721	http://www4.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00002721----000-.html	
21	Video Privacy Protection Act (VPPA), 18 USC 2710	http://www.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00002710----000-.html	
22	FDA Electronic Records; Electronic Signatures FDA 21 CFR Part 11+D1	http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&amp;sid=a486dc03a379dd084f837db8a3150cf2&amp;rgn=div5&amp;view=text&amp;node=21:1.0.1.1.7&amp;idno=21	
23	Family Education Rights Privacy Act (FERPA), 20 USC 1232	http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr;sid=432bbda77876ee638be366c1091527ec;rgn=div5;view=text;node=34%3A1.1.1.1.34;idno=34;cc=ecfr	
24	49 CFR Part 1542 - Airport Security	http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&amp;sid=4f4fe996be869c46e7a2469576734601&amp;rgn=div5&amp;view=text&amp;node=49:9.1.3.5.10&amp;idno=49	
25	Privacy Act of 1974, 5 USC 552a	http://www.usdoj.gov/opcl/privacyact1974.htm	
26	Chemical Facility Anti-Terrorism Standards (CFATS), Department of Homeland Security, 6 CFR Part 27	http://www.dhs.gov/xprevprot/laws/gc_1166796969417.shtm	
27	ACH (Automated Clearing House) Operating Rules OCC Bulletin 2004-58	http://www.occ.treas.gov/ftp/bulletin/2004-58.txt	
28	AICPA Incident Response Plan: Template for Breach of Personal Information	http://www.cica.ca/multimedia/Download_Library/Research_Guidance/Privacy/English/Incident_Response_Plan_May_2005.pdf	
29	AICPA SAS No. 94, The Effect of Information Technology on the Auditor's Consideration of Internal Controls	http://www.aicpa.org/pubs/cpaltr/jun2001/auditing.htm	
30	AICPA Suitable Trust Services Principles and Criteria	http://www.aicpa.org/download/trust_services/final-Trust-Services.pdf	
31	AICPA/CICA Privacy Framework	http://ftp.aicpa.org/CSC/infotech/Privacy/3A_01a.pdf	
32	Alaska Personal Information Protection Act, Chapter 48	http://www.legis.state.ak.us/PDF/25/Bills/HB0065Z.PDF	
33	American Express Data Security Standard (DSS)	https://www209.americanexpress.com/merchant/singlevoice/dsw/FrontServlet?request_type=dsw&amp;pg_nm=merchinfo&amp;ln=en&amp;frm=US	
34	Appendix III to OMB Circular No. A-130: Security of Federal Automated Information Resources	http://www.whitehouse.gov/omb/circulars/a130/a130appendix_iii.html	
35	Safety and Soundness Standards, Appendix of OCC 12 CFR 30	http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&amp;sid=55f63dbb4ec993a25080b4cb3eb14e06&amp;rgn=div5&amp;view=text&amp;node=12:1.0.1.1.28&amp;idno=12	
36	Argentina Personal Data Protection Act	http://www.privacyinternational.org/article.shtml?cmd%5B347%5D=x-347-61939	
37	Arizona State Law 44-7501. Notification of breach of security system	http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/44/07501.htm&amp;Title=44&amp;DocType=ARS	
38	Arkansas Code Title 4 Business and Commercial Law Subtitle 7 Consumer Protection, Chapter 110 Personal Information, §§ 4-110-103 thru 4 -110-105, Personal Information Protection Act	http://www.arkleg.state.ar.us/SearchCenter/Pages/ArkansasCodeSearchResultPage.aspx?name=4-110-103.Definitions.	
39	Arkansas Personal Information Protection Act AR SB 1167	ftp://www.arkleg.state.ar.us/acts/2005/public/Act1526.pdf	
40	Army Regulation 380-19: Information Systems Security	http://www.fas.org/irp/doddir/army/r380_19.pdf	
41	Australia Better Practice Guide - Business Continuity Management	http://www.anao.gov.au/uploads/documents/Business_Continuity_Management.pdf	
42	Australia Privacy Act 1988	http://www.comlaw.gov.au/ComLaw/Legislation/ActCompilation1.nsf/framelodgmentattachments/782CE59D0E879E1ACA2571FE001D50E6	
43	Australia Spam Act	http://www.austlii.edu.au/au/legis/cth/consol_act/sa200366/	
44	Australia Spam Act 2003: A practical guide for business	http://www.acma.gov.au/acmainterwr/consumer_info/frequently_asked_questions/spam_business_practical_guide.pdf	
45	Australia Telecommunications Act 1997	http://www.comlaw.gov.au/ComLaw/Legislation/ActCompilation1.nsf/framelodgmentattachments/40762BCB845F1313CA2570F2007B810C	
46	Australian Government ICT Security Manual (ACSI 33)	http://www.dsd.gov.au/_lib/pdf_doc/acsi33/acsi33_changes_u.rtf	
47	Austria Data Protection Act	http://www.dsk.gv.at/site/6230/default.aspx	
48	Austria Telecommunications Act	http://www.rtr.at/en/tk/TKG2003/TKG_2003_eng.pdf	
49	Aviation and Transportation Security Act, Public Law 107 Released-71, November 2001	http://www.tsa.gov/assets/pdf/Aviation_and_Transportation_Security_Act_ATSA_Public_Law_107_1771.pdf	
50	Bank Secrecy Act (aka The Currency and Foreign Transaction Reporting Act)	http://www.occ.treas.gov/handbook/bsa.pdf	
51	Basel II: International Convergence of Capital Measurement and Capital Standards - A Revised Framework	http://www.bis.org/publ/bcbs128.pdf	
52	BBBOnline Code of Online Business Practices	http://www.bbbonline.org/reliability/code/CodeEnglish.doc	
53	Belgian Law of 8 December 1992 on the protection of privacy in relation to the processing of persona	http://www.privacycommission.be/en/static/pdf/wetgeving/privacywet-en-input-website-220109.pdf	
54	BIS Sound Practices for the Management and Supervision of Operational Risk	http://www.bis.org/publ/bcbs96.pdf	
55	Bosnia Law on Protection of Personal Data	http://www.privacyinternational.org/countries/bosnia/bosnia-dpa.html	
56	BS25999, Guide to Business Continuity Management	http://www.thebci.org/pas56.htm	
57	CA Civil Code 1798.84	http://www.leginfo.ca.gov/cgi-bin/displaycode?section=civ&amp;group=01001-02000&amp;file=1798.80-1798.84	
58	Cable Communications Privacy Act Title 47 § 551	http://www4.law.cornell.edu/uscode/html/uscode47/usc_sec_47_00000551----000-.html	
59	California Civil Code § 1798.91 State Prohibitions on Marketing Practices using Medical Information	http://www.leginfo.ca.gov/cgi-bin/displaycode?section=civ&amp;group=01001-02000&amp;file=1798.91	
60	California Civil Code Title 1.8 Personal Data Chapter 1 Information Practices Act of 1977 Article 7. Accounting of Disclosures §§ 1798.25-1798.29	http://www.leginfo.ca.gov/cgi-bin/displaycode?section=civ&amp;group=01001-02000&amp;file=1798.25-1798.29	
61	California Civil Code Title 1.81 Customer Records §§ 1798.80-1798.84	http://www.leginfo.ca.gov/cgi-bin/displaycode?section=civ&amp;group=01001-02000&amp;file=1798.80-1798.84	
62	California General Security Standard for Businesses CA AB 1950	http://info.sen.ca.gov/pub/03-04/bill/asm/ab_1901-1950/ab_1950_bill_20040929_chaptered.pdf	
63	California Information Practice Act, CA SB 1386	http://info.sen.ca.gov/pub/01-02/bill/sen/sb_1351-1400/sb_1386_bill_20020926_chaptered.html	
64	California OPP Recommended Practices on Notification of Security Breach	http://www.oispp.ca.gov/consumer_privacy/pdf/secbreach.pdf	
65	California Personal Information: Disclosure to Direct Marketers Act (SB 27)	http://info.sen.ca.gov/cgi-bin/postquery?bill_number=sb_27&amp;sess=0304&amp;house=B&amp;site=sen	
66	California Public Records Military Veteran Discharge Documents, California Assembly Bill 1798	http://info.sen.ca.gov/pub/01-02/bill/asm/ab_1751-1800/ab_1798_bill_20020424_amended_asm.pdf	
67	California Public Records Military Veteran Discharge Documents, California Assembly Bill 1798	http://info.sen.ca.gov/pub/01-02/bill/asm/ab_1751-1800/ab_1798_bill_20020626_amended_sen.pdf	
68	California Senate Bill 20 (2009, Simitian), An act to amend Sections 1798.29 and 1798.82 of the Civil Code, relating to personal information	http://info.sen.ca.gov/pub/09-10/bill/sen/sb_0001-0050/sb_20_bill_20090908_enrolled.html	
69	Canada Personal Information Protection Electronic Documents Act (PIPEDA)	http://laws.justice.gc.ca/en/ShowTdm/cs/P-8.6///en	
70	Canada Privacy Act	http://laws.justice.gc.ca/en/ShowTdm/cs/p-21///en	
71	Canadian Marketing Association Code of Ethics and Standards of Practice	http://www.the-cma.org/?WCE=C=47%7CK=225849	
72	CERT Operationally Critical Threat, Asset &amp; Vulnerability Evaluation (OCTAVE)	http://www.cert.org/octave/	
73	Children's Online Privacy Protection Act of 1998	http://www.ftc.gov/ogc/coppa1.htm	
74	CISWG Information Security Program Elements	http://www.cisecurity.org/Documents/BPMetricsTeamReportFinal111704Rev11005.pdf	
75	Clinger-Cohen Act (Information Technology Management Reform Act)	http://www.cio.gov/Documents/it_management_reform_act_Feb_1996.html	
76	CMS Business Partners Systems Security Manual	http://www.cms.hhs.gov/manuals/downloads/117_systems_security.pdf	
77	CMS Core Security Requirements (CSR)	http://wedi.org/cmsUploads/pdfUpload/WEDIBulletin/pub/Copy_of_CSR_HIPAAMatrixFeb05final.pdf	
78	CMS Information Security Risk Assessment _IS RA_ Procedure	http://www.cms.hhs.gov/informationsecurity/downloads/IS_RA_Procedure.pdf	
79	CobiT	http://www.isaca.org/Content/NavigationMenu/Members_and_Leaders/COBIT6/Obtain_COBIT/Obtain_COBIT.htm	
80	CobiT 4.1	http://www.isaca.org/Content/NavigationMenu/Members_and_Leaders/COBIT6/Obtain_COBIT/Obtain_COBIT.htm	
81	Code of Alabama, Article 10 The Consumer Identity Protection Act, § 13A-8-190 thru § 13A-8-201	http://alisondb.legislature.state.al.us/acas/CodeOfAlabama/1975/147638.htm	
82	CODE OF CORPORATE GOVERNANCE 2005	http://www.ecgi.org/codes/documents/singapore_ccg_2005.pdf	
83	Colorado Consumer Credit Solicitation Protection, CO HB 04-1274	http://www.state.co.us/gov_dir/leg_dir/olls/sl2004a/sl_205.htm	
84	Colorado Disposal of Personal Identifying Documents C.R.S. 6-1-713	http://www.michie.com/colorado/lpext.dll/cocode/2/98ff/9921/9923/9cc7/9dbf?f=templates&amp;fn=document-frame.htm&amp;2.0#JD_6-1-713	
85	Colorado Prohibiting Inclusion of Social Security Number, CO HB 04-1311	http://www.state.co.us/gov_dir/leg_dir/olls/sl2004a/sl_393.htm	
86	Colorado Prohibition against Using Identity Information for Unlawful Purpose, CO HB 04-1134	http://www.state.co.us/gov_dir/leg_dir/olls/sl2004a/sl_365.htm	
87	Colorado Revised Statutes 6-1-716, Notice of Security Breach	http://www.michie.com/colorado/lpext.dll?f=templates&amp;fn=main-h.htm&amp;cp=	
88	Colorado Revised Statutes Title 16 Article 5 Section 103 Identity theft victims - definitions	http://www.michie.com/colorado/lpext.dll/cocode/2/29af3/29b24/2a406/2a420/2a43e?f=templates&amp;fn=document-frame.htm&amp;2.0#JD_16-5-103	
89	Computer Fraud and Abuse Act	http://www.law.cornell.edu/uscode/18/1030.html	
90	Computer Security Incident Handling Guide, NIST SP 800-61	http://csrc.nist.gov/publications/nistpubs/800-61-rev1/SP800-61rev1.pdf	
91	Connecticut law Concerning Nondisclosure of Private Tenant Information, CT HB 5184	http://www.cga.ct.gov/2004/act/Pa/2004PA-00119-R00HB-05184-PA.htm	
92	Connecticut law Requiring Consumer Credit Bureaus to Offer Security Freezes, CT SB 650	http://www.cga.ct.gov/2005/act/Pa/2005PA-00148-R00SB-00650-PA.htm	
93	Connecticut Public Act 08-167, An Act Concerning the Confidentiality of Social Security Numbers	http://www.cga.ct.gov/2008/ACT/Pa/pdf/2008PA-00167-R00HB-05658-PA.pdf	
94	Connecticut State Law Sec. 36a-701b. Breach of security re computerized data containing personal information. Disclosure of breach. Delay for criminal investigation. Means of notice. Unfair trade prac	http://www.cga.ct.gov/2009/pub/chap669.htm#Sec36a-701b.htm	
95	Consumer Interests in the Telecommunications Market, Act No. 661	http://en.itst.dk/numbering-issues-and-domain-aspects/legal-matters	
96	Contingency Planning Guide for Information Technology Systems, NIST SP 800-34	http://csrc.nist.gov/publications/nistpubs/800-34/sp800-34.pdf	
97	Controlling the Assault of Non=Solicited Pornography and Marketing Act of 2003	http://www.spamlaws.com/f/pdf/pl108-187.pdf	
98	Corporate Governance in listed Companies – Clause 49 of the Listing Agreement	http://www.bseindia.com/downloads/CorpGov281004.zip	
99	Corporate Information Security Working Group: Report of the best practices and metrics teams; subcommittee on technology, information policy, intergovernmental relations and the census; Government Ref	http://net.educause.edu/ir/library/pdf/CSD3661.pdf	
100	Corporate Law Economic Reform Program (Audit Reform and Corporate Disclosure) Act 2004	http://www.comlaw.gov.au/comlaw/management.nsf/lookupindexpagesbyid/IP200402596?OpenDocument	
101	COSO Enterprise Risk Management (ERM) Integrated Framework (2004)	https://www.cpa2biz.com/CS2000/Products/CPA2BIZ/Publications/COSO+Enterprise+Risk+Management+-+Integrated+Framework.htm	
102	C-TPAT Supply Chain Security Best Practices Catalog	http://www.pac-am.com/docs/CTPATBestPractices.pdf	
103	Customs-Trade Partnership Against Terrorism (C-TPAT) Importer Security Criteria	http://www.cbp.gov/xp/cgov/trade/cargo_security/ctpat/security_criteria/criteria_importers/ctpat_importer_criteria.xml	
104	Czech Republic Personal Data Protection Act	http://ec.europa.eu/justice_home/fsj/privacy/docs/implementation/czech_republic_act_101_en.pdf	
105	Defense Industrial Base Information Assurance Standard	http://www.dhs.gov/xlibrary/assets/DIB_SSP_5_21_07.pdf	
106	Defense Information Systems Agency UNISYS Security Technical Implementation Guide Version 7 Release 2	http://iase.disa.mil/stigs/stig/UNISYS-STIG-V7R2.doc	
107	Defense Information Systems Agency UNIX Security Technical Implementation Guide Version 5 Release 1	http://iase.disa.mil/stigs/stig/unix-stig-v5r1.pdf	
108	Delaware Code TITLE 6 Commerce and Trade, Subtitle II Other Laws Relating to Commerce and Trade ,Chapter 12B. Computer Security Breaches, §§ 12B-101 thru 104	http://delcode.delaware.gov/title6/c012b/index.shtml	
109	Denmark Act on Competitive Conditions and Consumer Interests	http://en.vtu.dk/acts/act-on-competitive-conditions-and-consumer-interest-in-the-telecommunications-market-a7114	
110	Denmark, The Act on Processing of Personal Data	http://www.datatilsynet.dk/english/the-act-on-processing-of-personal-data/	
111	Design Criteria Standard for Electronic Records Management Software Application, DOD 5015.2	http://jitc.fhu.disa.mil/recmgt/p50152s2.pdf	
112	Direct Marketing Association – Privacy Promise	http://www.the-dma.org/privacy/index.shtml	
113	EU Directive on Privacy and Electronic Communications, 2002/58/EC	http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:EN:HTML	
114	Directive 2003/4/EC Of The European Parliament	http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2003:041:0026:0032:EN:PDF	
115	EU Directive on Data Protection, 95/46/EC	http://www.cdt.org/privacy/eudirective/EU_Directive_.html	
116	DISA Secure Remote Computing Security Technical Implementation Guide version 1.2	http://iase.disa.mil/stigs/stig/src-stig-v1r2.pdf	
117	DISA Windows Server 2003 Security Checklist Version 6 Release 1.11	http://iase.disa.mil/stigs/stig/win2k-XP-03-vista-addendumv6r1-052107.doc	
118	DISA Windows VISTA Security Checklist	http://iase.disa.mil/stigs/stig/win2k-XP-03-vista-addendumv6r1-052107.doc	
119	DISA Windows XP Security Checklist	http://iase.disa.mil/stigs/checklist/windows_xp_checklist_v6r1-11_20090424.zip	
120	DISA WIRELESS SECURITY CHECKLIST, Version 5, Release 2.2	http://iase.disa.mil/stigs/stig/wireless_stig_v5r2.pdf	
121	DISA Wireless STIG Motorola Good Mobile Wireless Email System Security Checklist, V5R2.3	http://iase.disa.mil/stigs/checklist/wireless_stig_good_mobile_messaging_checklist_v5r2-3_final_14apr2009.pdf	
122	Disaster / Emergency Management and Business Continuity, NFPA 1600	http://www.nfpa.org/assets/files/pdf/nfpa1600.pdf	
123	District of Columbia Official Code, Division V Local Business Affairs, Title 28. Commercial Instruments and Transactions, Chapter 38. Consumer Protections, Subchapter II. Consumer Security Breach Noti	http://www.dccouncil.washington.dc.us/images/00001/20061218135855.pdf	
124	DOT Physical Security Survey Checklist	http://transit-safety.volpe.dot.gov/training/Archived/EPSSeminarReg/CD/Documents/OHIO_DOT/physicalsecurity.doc	
125	Equal Credit Opportunity Act (Reg. B)	http://www.fdic.gov/regulations/laws/rules/6500-2900.html	
126	EU 8th Directive (European SOX)	http://www.8th-company-law-directive.com/8thCompanyLaw.htm	
127	Fair and Accurate Credit Transactions Act of 2003 (FACT Act)	http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=108_cong_public_laws&amp;docid=f:publ159.108	
128	Fair Credit Reporting Act (FCRA)	http://www.ftc.gov/os/statutes/031224fcra.pdf	
129	FDCC SCAP OVAL Patches - IE7	http://nvd.nist.gov/chklst_detail.cfm?config_id=171	
130	Federal Information Security Management Act of 2002 (FISMA)	http://csrc.nist.gov/drivers/documents/FISMA-final.pdf	
131	Federal Information System Controls Audit Manual (FISCAM)	http://www.gao.gov/new.items/d09232g.pdf	
132	Federal Rules of Civil Procedure (2007)	http://www.law.cornell.edu/rules/frcp/	
133	FERC Security Program for Hydropower Projects	http://www.ferc.gov/industries/hydropower/safety/guidelines/security/securitytext.pdf	
134	FFIEC Guidance on Authentication in an Internet Banking Environment	http://www.ffiec.gov/pdf/authentication_guidance.pdf	
135	FFIEC IT Examination Handbook – Audit	http://www.ffiec.gov/ffiecinfobase/booklets/audit/audit.pdf	
136	FFIEC IT Examination Handbook – Business Continuity Planning	http://www.ffiec.gov/ffiecinfobase/booklets/bcp/bus_continuity_plan.pdf	
137	FFIEC IT Examination Handbook – Development and Acquisition	http://www.ffiec.gov/ffiecinfobase/booklets/d_a/d_and_a.pdf	
138	FFIEC IT Examination Handbook – E-Banking	http://www.ffiec.gov/ffiecinfobase/booklets/e_banking/e_banking.pdf	
139	FFIEC IT Examination Handbook – Information Security	http://www.ffiec.gov/ffiecinfobase/booklets/information_security/information_security.pdf	
140	FFIEC IT Examination Handbook – Management	http://www.ffiec.gov/ffiecinfobase/booklets/mang/mang.pdf	
141	FFIEC IT Examination Handbook – Operations	http://www.ffiec.gov/ffiecinfobase/booklets/operations/operation.pdf	
142	FFIEC IT Examination Handbook – Outsourcing Technology Services	http://www.ffiec.gov/ffiecinfobase/booklets/outsourcing/Outsourcing_Booklet.pdf	
143	FFIEC IT Examination Handbook – Retail Payment Systems	http://www.ffiec.gov/ffiecinfobase/booklets/Retail/retail.pdf	
144	FFIEC IT Examination Handbook – Supervision of Technology Service Providers	http://www.ffiec.gov/ffiecinfobase/booklets/tsp/tech_ser_provider.pdf	
145	FFIEC IT Examination Handbook – Wholesale Payment Systems	http://www.ffiec.gov/ffiecinfobase/booklets/Wholesale/whole.pdf	
146	Financial Reporting Council, Combined Code on Corporate Governance	http://www.frc.org.uk/documents/pagemanager/frc/Combined_Code_June_2008/Combined%20Code%20Web%20Optimized%20June%202008(2).pdf	
147	Finland act on the amendment of the Personal Data Act (986/2000)	http://www.tietosuoja.fi/uploads/p9qzq7zr3xxmm9j.rtf	
148	Finland Act on the Protection of Privacy in Electronic Communications	http://www.finlex.fi/en/laki/kaannokset/2004/en20040516.pdf	
149	Finland Personal Data Protection Act (523/1999)	http://www.tietosuoja.fi/uploads/hopxtvf.HTM	
150	FIPS 140-2, Security Requirements for Cryptographic Modules	http://csrc.nist.gov/publications/fips/fips140-2/Fips140-2.zip	
151	FIPS 191, Guideline for the Analysis of Local Area Network (LAN) Security	http://csrc.nist.gov/publications/fips/fips191/fips191.pdf	
152	FIPS 199, Standards for Security Categorization of Federal Information and Information Systems	http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf	
153	FIPS 200, Minimum Security Requirements for Federal Information and Information Systems	http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf	
154	Florida Personal Identification Information/Unlawful Use, FL HB 481	http://www.myfloridahouse.gov/Sections/Bills/billsdetail.aspx?BillId=15974	
155	Florida Statute 817.5681  Breach of security concerning confidential personal information in third-party possession	http://www.leg.state.fl.us/statutes/index.cfm?mode=View%20Statutes&amp;SubMenu=1&amp;App_mode=Display_Statute&amp;Search_String=breach+of+security&amp;URL=CH0817/Sec5681.HTM	
156	France Data Processing, Data Files and Individual Liberties	http://www.cnil.fr/fileadmin/documents/en/Act78-17VA.pdf	
157	FTC Electronic Signatures in Global and National Commerce Act (ESIGN)	http://www.ftc.gov/os/2001/06/esign7.htm	
158	FTC FACT Act Red Flags Rule Template	http://www.finra.org/Industry/Issues/CustomerInformationProtection/p118480	
159	GAO/PCIE Financial Audit Manual (FAM)	http://www.gao.gov/special.pubs/gaopcie/	
160	General Laws of Massachusetts, Part I, Title XV Chapter 93H, Security Breaches	http://www.mass.gov/legis/laws/mgl/gl-93h-toc.htm	
161	Generally Accepted Principles and Practices for Securing Information Technology Systems, NIST SP 800-14	http://csrc.nist.gov/publications/nistpubs/800-14/800-14.pdf	
162	Georgia Code Title 10 Chapter 1 Article 34 § 10-1-911 thru 10-1-915 Notification required upon breach of security regarding personal information	http://www.legis.state.ga.us/legis/2005_06/fulltext/sb230.htm	
163	Georgia Public employees; Fraud, Waste, and Abuse, GA HB 656	http://www.legis.state.ga.us/legis/2005_06/fulltext/hb656.htm	
164	German Corporate Governance Code ("The Code")	http://www.corporate-governance-code.de/eng/download/E_Kodex%202008_final.pdf	
165	German Federal Data Protection Act	http://www.bdd.de/Download/bdsg_eng.pdf
https://www.datenschutzzentrum.de/material/recht/eu-datenschutzrichlinie-eng.htm
https://www.datenschutzzentrum.de/material/recht/bdsg.htm
https://www.datenschutzzentrum.de/material/recht/ldsg-eng.htm 	
166	Gramm-Leach-Bliley Act (GLB)	http://www.ftc.gov/privacy/glbact/glbsub1.htm	
167	Greece Law Protection of personal data and privacy in electronic telecommunications sector (Law 3471)	http://www.dpa.gr/pls/portal/docs/PAGE/APDPX/ENGLISH_INDEX/LEGAL%20FRAMEWORK/LAW%203471-2006-EN.PDF	
168	Guidance for Protecting Building Environments from Airborne Chemical, Biological, or Radiological Attacks, NIOSH, May 2002, DHHS (NIOSH) Publication No. 2002-139	http://www.cdc.gov/niosh/docs/2002-139/pdfs/2002-139.pdf	
169	Guidance for Securing Microsoft Windows XP Systems for IT Professionals, NIST SP 800-68	http://csrc.nist.gov/itsec/SP800-68r1.pdf	
170	Guide for Assessing the Security Controls in Federal Information Systems,  NIST SP 800-53A	http://csrc.nist.gov/publications/nistpubs/800-53A/SP800-53A-final-sz.pdf	
171	Guide for Developing Performance Metrics for Information Security, NIST SP 800-80	http://csrc.nist.gov/publications/drafts.html#sp800-80	
172	Guide for Developing Security Plans for Federal Information Systems, NIST SP 800-18	http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf	
173	Guide for Mapping Types of Information and Information Systems to Security Categories, NIST SP 800-60	http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf	
174	Guide to Protecting the Confidentiality of Personally Identifiable Information (PII), NIST SP 800-122	http://csrc.nist.gov/publications/drafts/800-122/Draft-SP800-122.pdf	
175	Guidelines for Media Sanitization, NIST Special Publication 800-88	http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf	
176	Guidelines on Cell Phone and PDA Security, NIST Special Publication 800-124	http://csrc.nist.gov/publications/nistpubs/800-124/SP800-124.pdf	
177	Guidelines on Firewalls and Firewall Policy, NIST SP 800-41	http://csrc.nist.gov/publications/nistpubs/800-41/sp800-41.pdf	
178	Hawaii Revised Statute § 487N. Security Breach of Personal Information	http://www.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0487N/	
179	Health Insurance Portability and Accountability Act of 1996 (HIPAA)	http://www.cms.hhs.gov/HIPAAGenInfo/Downloads/HIPAALaw.pdf	
180	HIPAA HCFA Internet Security Policy	http://csrc.nist.gov/groups/SMA/fasp/documents/policy_procedure/internet_policy.pdf	
181	Hong Kong Personal Data (Privacy) Ordinance	http://www.pco.org.hk/textonly/english/ordinance/section_01.html	
182	Hungary Protection of Personal Data and Disclosure of Data of Public Interest	http://abiweb.obh.hu/dpc/index.php?menu=gyoker/relevant/national/1992_LXIII	
183	Iceland Protection of Privacy as regards the Processing of Personal Data	http://www.personuvernd.is/information-in-english/greinar//nr/438	
184	Idaho Code Title 28 Commercial Transactions, Chapter 51 Identity Theft	http://www3.state.id.us/idstat/TOC/28051KTOC.html	
185	Identity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003	http://www.ftc.gov/os/fedreg/2007/november/071109redflags.pdf	
186	IIA Global Technology Audit Guide (GTAG): Information Technology Controls	http://www.theiia.org/guidance/standards-and-guidance/ippf/practice-guides/gtag/gtag1/	
187	IIA Global Technology Audit Guide (GTAG):Change and Patch Management Controls: Critical for Organizational Success	http://www.theiia.org/guidance/standards-and-guidance/ippf/practice-guides/gtag/gtag2/	
188	IIA Global Technology Audit Guide (GTAG): Continuous Auditing: Implications for Assurance, Monitoring, and Risk Assessment	http://www.theiia.org/guidance/standards-and-guidance/ippf/practice-guides/gtag/gtag3/	
189	IIA Global Technology Audit Guide (GTAG): Management of IT Auditing	http://www.theiia.org/guidance/standards-and-guidance/ippf/practice-guides/gtag/gtag4/	
190	IIA Global Technology Audit Guide (GTAG): Managing and Auditing Privacy Risks	http://www.theiia.org/guidance/standards-and-guidance/ippf/practice-guides/gtag/gtag5/	
191	IIA Global Technology Audit Guide (GTAG): Managing and Auditing IT Vulnerabilities	http://www.theiia.org/guidance/standards-and-guidance/ippf/practice-guides/gtag/gtag6/	
192	IIA Global Technology Audit Guide (GTAG): Information Technology Outsourcing	http://www.theiia.org/guidance/standards-and-guidance/ippf/practice-guides/gtag/gtag7/	
193	IIA Global Technology Audit Guide (GTAG): Auditing Application Controls	http://www.theiia.org/guidance/standards-and-guidance/ippf/practice-guides/gtag/gtag8/	
194	Illinois Compiled Statutes, Chapter 815, ILCS 530/Personal Information Protection Act.	http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=2702&amp;ChapAct=815%26nbsp%3BILCS%26nbsp%3B530%2F&amp;ChapterID=67&amp;ChapterName=BUSINESS+TRANSACTIONS&amp;ActName=Personal+Information+Protection+Act%2E	
195	Illinois Personal Information Protection Act IL HB 1633	http://www.ilga.gov/legislation/publicacts/fulltext.asp?Name=094-0036	
196	Implementation Guide for OMB Circular A-123 Management’s Responsibility for Internal Control	http://www.cfoc.gov/index.cfm?function=specdoc&amp;id=Implementation%20Guide%20for%20OMB%20Circular%20A-123&amp;structure=OMB%20Documents%20and%20Guidance&amp;category=Guides	
197	India Information Technology Act (ITA-2000)	http://www.naavi.org/ita_2006/compare_ita2000_vs_ita2006/index.htm	
198	Indiana Code 24, Article 4.9. Disclosure of Security Breach	http://www.in.gov/legislative/ic/code/title24/ar4.9/	
199	Indiana Code 24, Notice of Security Breach, Chapter 11	http://www.in.gov/legislative/ic/code/title4/ar1/ch11.html	
200	Indiana Release of Social Security Number, Notice of Security Breach IN SB 503	http://www.in.gov/legislative/bills/2005/SE/SE0503.1.html	
201	Information Technology Security Evaluation Criteria (ITSEC)	http://www.iwar.org.uk/comsec/resources/standards/itsec.htm	
202	Information Technology Security Evaluation Manual (ITSEM)	http://www.bsi.bund.de/zertifiz/itkrit/itsem-en.pdf	
203	Internet Security: Distributed Denial of Service Attacks – OCC Alert 2000-1	http://www.occ.treas.gov/ftp/alert/2000-1.txt	
204	Iowa Code Annotated § 614.4a	http://coolice.legis.state.ia.us/Cool-ICE/default.asp?category=billinfo&amp;service=IowaCode&amp;ga=83&amp;input=614#614.4A	
205	Iowa Code Annotated § 714.16B Civil Cause of Action	http://www.legis.state.ia.us/IACODE/2001SUPPLEMENT/714/16B.html	
206	Iowa Code Annotated § 715C Personal Information Security Breach Protection	http://coolice.legis.state.ia.us/Cool-ICE/default.asp?category=billinfo&amp;service=IowaCode&amp;ga=83	
207	Ireland Consolidated Data Protection Acts of 1988 and 2003	http://www.dataprotection.ie/documents/legal/DPAConsolMay09.pdf	
208	Ireland Data Protection Act of 1988	http://www.irishstatutebook.ie/1988/en/act/pub/0025/index.html	
209	Ireland Data Protection Amendment 2003	http://www.irishstatutebook.ie/2003/en/act/pub/0006/index.html	
210	IRS Publication 1075: TAX INFORMATION SECURITY GUIDELINES FOR FEDERAL, STATE AND LOCAL AGENCIES AND ENTITIES; Safeguards for Protecting Federal Tax Returns and Return Information	http://www.irs.gov/pub/irs-pdf/p1075.pdf	
211	IRS Revenue Procedure: Record retention: automatic data processing, 98-25	http://www.unclefed.com/Tax-Bulls/1998/rp98-25.pdf	
212	IRS Revenue Procedure: Retention of books and records, 97-22	http://www.recapinc.com/irs_97-22.htm	
213	ISACA Cross-Border Privacy Impact Assessment	http://www.isaca.org/Template.cfm?Section=Home&amp;CONTENTID=17226&amp;TEMPLATE=/ContentManagement/ContentDisplay.cfm	
214	ISACA IS Standards, Guidelines, and Procedures for Auditing and Control Professionals	http://www.isaca.org/AMTemplate.cfm?Section=Standards2&amp;Template=/ContentManagement/ContentDisplay.cfm&amp;ContentID=27785	
215	ISF Security Audit of Networks	 	
216	ISF Standard of Good Practice for Information Security	https://www.isfsecuritystandard.com/SOGP07/index.htm	
217	ISO 15489-1:2001, Information and Documentation: Records management: Part 1: General	http://www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=31908	
218	ISO 15489-2: 2001, Information and Documentation: Records management: Part 2: Guidelines	http://www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=35845	
219	ISO 13335-1:2004, Information technology — Security techniques — Management of information and communications technology security — Part 1: Concepts and models for information and communications techn	http://www.iso.ch/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=39066	
220	ISO 13335-3:1998, Information technology — Guidelines for the management of IT Security — Part 3: Techniques for the management of IT Security	http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=21756	
221	ISO 13335-4:2000, Information technology — Guidelines for the management of IT Security — Part 4: Selection of safeguards	http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=29240	
222	ISO 13335-5:2001, Information technology — Guidelines for the management of IT Security — Part 5: Management guidance on network security	http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=31142	
223	ISO/IEC 15408-1:2005 Common Criteria for Information Technology Security Evaluation Part 1	http://www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=40612&amp;ICS1=35&amp;ICS2=40&amp;ICS3=	
224	ISO/IEC 15408-2:2008 Common Criteria for Information Technology Security Evaluation Part 2	http://www.iso.org/iso/iso_catalogue/catalogue_ics/catalogue_detail_ics.htm?csnumber=46414	
225	ISO/IEC 15408-3:2008 Common Criteria for Information Technology Security Evaluation Part 3	http://www.iso.org/iso/iso_catalogue/catalogue_ics/catalogue_detail_ics.htm?csnumber=46413	
226	ISO 17799:2000, Code of Practice for Information Security Management	http://www.iso.ch/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=39612&amp;ICS1=35&amp;ICS2=40&amp;ICS3=	
227	ISO 17799:2005 Code of Practice for Information Security Management	http://www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=39612&amp;ICS1=35&amp;ICS2=40&amp;ICS3=	
228	ISO/IEC 18045:2005 Common Methodology for Information Technology Security Evaluation Part 3	http://www.iso.org/iso/iso_catalogue/catalogue_ics/catalogue_detail_ics.htm?csnumber=46412	
229	ISO/IEC 18045:2008 Common Methodology for Information Technology Security Evaluation	http://www.iso.org/iso/iso_catalogue/catalogue_ics/catalogue_detail_ics.htm?csnumber=46412	
230	ISO/IEC 20000-1:2005 Information technology - Service Management Part 1	http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=41332	
231	ISO/IEC 20000-2:2005 Information technology - Service Management Part 2	http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=41333	
232	ISO 27001:2005, Information Security Management Systems - Requirements	http://www.iso.ch/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=42103&amp;ICS1=35&amp;ICS2=40&amp;ICS3	
233	ISO/IEC 27002-2005 Code of practice for information security management	http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=50297	
234	ISO 73:2002, Risk Management - Vocabulary	http://www.iso.ch/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=34998	
235	ISSA Generally Accepted Information Security Principles (GAISP)	http://all.net/books/standards/GAISP-v30.pdf	
236	IT Baseline Protection Manual Standard Security Safeguards Germany	http://www.iwar.org.uk/comsec/resources/standards/germany/itbpm/menue.htm	
237	IT Service Management Standard - Code of Practice, BS ISO/IEC 20000-2:2005	http://20000.standardsdirect.org/	
238	IT Service Management Standard , BS ISO/IEC 20000-1:2005	http://20000.standardsdirect.org/	
239	Italy Personal Data Protection Code	http://www.garanteprivacy.it/garante/document?ID=311066	
240	Italy Protection of Individuals Other Subject with regard to the Processing of Personal Data	http://www.euroacustici.org/eng/Privacy.pdf	
241	Japan Act on the Protection of Personal Information Protection (Law No. 57 of 2003)	http://www5.cao.go.jp/seikatsu/kojin/foreign/act.pdf	
242	Japan ECOM Guidelines Concerning the Protection of Personal Data in Electronic Commerce in the Private Sector (version 1.0)	http://www.ecom.jp/ecom_e/report/full/personal.pdf	
243	Japan Handbook Concerning Protection Of Personal Data	http://www.meti.go.jp/english/information/downloadfiles/Taro9-eng.pdf	
244	Kansas Statutes Chapter 50, Article 7a Protection Of Consumer Information	http://kansasstatutes.lesterama.org/Chapter_50/Article_7a/	
245	Kentucky Revised Statutes Title III Chapter 15  § 113 Prevention of Identity Theft	http://www.lrc.ky.gov/KRS/015-00/113.PDF	
246	Kentucky Revised Statutes Title XXXVI Chapter 411 § 210 Action for theft of identity or trafficking in stolen identities	http://www.lrc.ky.gov/KRS/411-00/210.PDF	
247	Korea Act on Promotion of Information &amp; Communication Network Utilization and Information Protection, etc	http://unpan1.un.org/intradoc/groups/public/documents/APCITY/UNPAN025694.pdf	
248	Korea Act on the Protection of Personal Information Maintained by Public Agencies 1994	http://www.glin.gov/view.action?glinID=202097	
249	Korea Act Relating to Use and Protection of Credit Information	http://www.glin.gov/view.action?glinID=99460	
250	Luxembourg Data Protection Law	http://www.cnpd.lu/objets/en/doc_loi02082002mod_en.pdf#zoom=125,0,0	
251	Specter-Leahy Personal Data Privacy and Security Act	http://leahy.senate.gov/press/200506/062905a.html	
252	Lithuania Law on Legal Protection of Personal Data	http://www.ada.lt/images/cms/File/pers.data.prot.law.pdf	
253	Louisiana Revised Statutes Title 51 §§ 3073-3074 Database Security Breach Notification Law	http://www.legis.state.la.us/lss/lss.asp?doc=322029	
254	Maine Revised Statutes Title 10, Part 3 Chapter 210-B Notice of Risk to Personal Data §§	http://www.mainelegislature.org/legis/statutes/10/title10ch210-Bsec0.html	
255	Maryland Code of Commercial Law Subtitle 35. Maryland Personal Information Protection Act §14-3501 thru §14-3508	http://www.michie.com/maryland/lpext.dll?f=templates&amp;fn=main-h.htm&amp;cp=mdcode	
256	Massachusetts 201 CMR 17.00: Standards for The Protection of Personal Information of Residents of the Commonwealth of Massachusetts	http://www.mass.gov/Eoca/docs/idtheft/201CMR17amended.pdf	
257	MasterCard Electronic Commerce Security Architecture Best Practices	http://www.powerpay.biz/docs/risk/MC_best_practices_online.pdf	
258	MasterCard Wireless LANs - Security Risks and Guidelines	http://www.mastercard.com/us/sdp/assets/pdf/wl_entire_manual.pdf	
259	Mexico Federal Personal Data Protection Law	https://www.agpd.es/upload/English_Resources/Mexico_declaration.pdf	
260	Michigan Identity Theft Protection Act, Act 452 of 2004, § 445.61 thru § 445.72a	http://legislature.mi.gov/doc.aspx?mcl-Act-452-of-2004	
261	Microsoft Developer Network Security Glossary	http://msdn.microsoft.com/en-us/library/ms721607(VS.85).aspx	
262	Microsoft Windows Vista Security Guide Appendix A: Security Group Policy Settings	http://technet.microsoft.com/en-us/bb629420.aspx	
263	Minnesota Plastic Card Security Act H.F. 1758	https://www.revisor.leg.state.mn.us/bin/bldbill.php?bill=H1758.4.html&amp;session=ls85	
264	Minnesota Statute § 13.055 State Agencies; Disclosure of Breach in Security	http://www.revisor.leg.state.mn.us/data/revisor/statute/2008/013/2008-13.055.pdf	
265	Minnesota Statute § 325E.61 Data Warehouses; Notice Required For Certain Disclosures	https://www.revisor.leg.state.mn.us/statutes/?id=325E.61#stat.325E.61	
266	Minnesota Statute § 325E.64 Access Devices; Breach of Security	https://www.revisor.leg.state.mn.us/statutes/?id=325E.64	
267	Missouri Revised Statutes Chapter 407 Merchandising Practices § 407.1500	http://www.moga.mo.gov/statutes/c400-499/4070001500.htm	
268	Montana bill to Implement Individual Privacy and to Prevent Identity Theft, MT HB 732	http://data.opi.state.mt.us/BILLS/2005/BillPDF/HB0732.pdf	
269	Montana Code § 30-14-1701 thru § 30-14-1705 and § 30-14-1721 thru § 30-14-1722; Protection of individual privacy and to impede identity theft as prohibited by § 45-6-332	http://data.opi.state.mt.us/bills/mca_toc/30_14_17.htm	
270	Montana Code § 45-6-332. Theft of identity	http://data.opi.state.mt.us/bills/mca/45/6/45-6-332.htm	
271	Multi-Function Device (MFD)and Printer Checklist for Sharing Peripherals Across the Network Security Technical Implementation Guide	http://iase.disa.mil/stigs/checklist/span_mfd_checklist_v1r1-3_04_15_2009.pdf	
272	NASD Manual	http://onlinestore.cch.com/default.asp?ProductID=1926	
273	National Incident Management System (NIMS), Department of Homeland Security, December 2008	http://www.fema.gov/pdf/emergency/nims/NIMS_core.pdf	
274	Nebraska Revised Statutes § 87-801 thru § 87-807, Data Protection and Consumer Notification of Data Security Breach Act of 2006	http://www.legislature.ne.gov/laws/browse-chapters.php?chapter=87	
275	Netherlands Personal Data Protection Act, Session 1999-2000 Nr.92	http://www.dutchdpa.nl/downloads_wetten/wbp.pdf?refer=true&amp;theme=purple	
276	Nevada Revised Statute Chapter 603A, Security of Personal Information	http://www.leg.state.nv.us/NRS/NRS-603A.html	
277	Nevada Security Breach Notification Law, NV SB 347	http://www.leg.state.nv.us/73rd/bills/SB/SB347_EN.pdf	
278	New Hampshire Statute Title XXXI, Chapter 359-C Right to Privacy, Notice of Security Breach	http://www.gencourt.state.nh.us/rsa/html/XXXI/359-C/359-C-mrg.htm	
279	New Jersey Identity Theft Prevention Act, NJ A4001/S1914	http://www.njleg.state.nj.us/2004/Bills/A3500/4001_I1.PDF	
280	New Jersey Permanent Statutes Title 56 Security of Personal Information	http://www.njleg.state.nj.us/2004/Bills/PL05/226_.HTM	
281	New York Disposal of Records Containing Personal Identifying Information NY CLS Gen Bus § 399-h	http://it.rockefeller.edu/pdf/disposal.pdf	
282	New York Information Security Breach and Notification Act	http://www.cscic.state.ny.us/security/securitybreach/	
283	New York State General Business Law Chapter 20, Article 39-F, § 899-aa	http://www.cscic.state.ny.us/lib/laws/documents/899-aa.pdf	
284	New Zealand Privacy Act 1993	http://www.legislation.govt.nz/act/public/1993/0028/latest/DLM296639.html	
285	NISPOM - National Industrial Security Program Operating Manual (DoD 5220.22-M) February 26, 2006	http://www.dtic.mil/whs/directives/corres/html/522022m.htm	
286	NIST SCAP Microsoft Internet Explorer Version 7.0 OVAL	http://nvd.nist.gov/chklst_detail.cfm?config_id=148	
287	North American Electric Reliability Corporation Critical Infrastructure Protection Cyber Security Standards	http://www.nerc.com/page.php?cid=2%7C20	
288	North Carolina Security Breach Notification Law (Identity Theft Protection Act of 2005)	http://www.ncleg.net/Sessions/2005/Bills/Senate/PDF/S1048v2.pdf	
289	North Carolina Statutes Chapter 75 Article 2A. Identity Theft Protection Act § 75-60 through § 75-66	http://www.ncga.state.nc.us/EnactedLegislation/Statutes/HTML/ByArticle/Chapter_75/Article_2A.html	
290	North Dakota Century Code, CHAPTER 51-30  Notice of Security Breach For Personal Information	http://www.legis.nd.gov/cencode/t51c30.pdf	
291	North Dakota Personal Information Protection Act, ND SB 2251	http://www.legis.nd.gov/assembly/59-2005/bill-text/FRBS0500.pdf	
292	NSA Guide to Securing Microsoft Windows 2000 Group Policy	http://www.nsa.gov/ia/_files/os/win2k/w2k_group_policy.pdf	
293	NSA Guide to Security Microsoft Windows XP	http://www.nsa.gov/ia/_files/os/winxp/Windows_XP_Security_Guide_v2.2.zip	
294	NYSE Listed Company Manual	http://nysemanual.nyse.com/lcm/	
295	OECD / World Bank Technology Risk Checklist	http://www.infragard.net/library/pdfs/technologyrisklist.pdf	
296	OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data	http://www.oecd.org/document/18/0,2340,en_17642234_17642806_1815186_1_1_1_1,00.html	
297	OECD Principles of Corporate Governance	http://www.oecd.org/DATAOECD/32/18/31557724.pdf	
298	OGC ITIL: Application Management	http://www.best-management-practice.com/Publications-Library/IT-Service-Management-ITIL/ITIL-Version-2/?DI=610977#GEMS6449817	
299	OGC ITIL: ICT Infrastructure Management	http://www.best-management-practice.com/Publications-Library/IT-Service-Management-ITIL/ITIL-Version-2/?DI=610977#GEMS6449815	
300	OGC ITIL: Planning to Implement Service Management	http://www.best-management-practice.com/Publications-Library/IT-Service-Management-ITIL/ITIL-Version-2/?DI=610977#GEMS6449809	
301	OGC ITIL: Security Management	http://www.best-management-practice.com/Publications-Library/IT-Service-Management-ITIL/ITIL-Version-2/?DI=610977#GEMS6449811	
302	OGC ITIL: Service Delivery	http://www.best-management-practice.com/Publications-Library/IT-Service-Management-ITIL/ITIL-Version-2/?DI=610977#GEMS6449807	
303	OGC ITIL: Service Support	http://www.best-management-practice.com/Publications-Library/IT-Service-Management-ITIL/ITIL-Version-2/?DI=610977#GEMS6449805	
304	Ohio Personal information - contact if unauthorized access, OH HB 104	http://www.legislature.state.oh.us/BillText126/126_HB_104_EN_N.pdf	
305	Ohio Revised Code Title XIII Chapter 1347 § 1347.12 Agency disclosure of security breach of computerized personal information data	http://codes.ohio.gov/orc/1347.12	
306	Ohio Revised Code Title XIII Chapter 1349 § 1349.19 Private disclosure of security breach of computerized personal information data	http://codes.ohio.gov/orc/1349.19	
307	Oklahoma Administrative Code Title 375 Chapter 40 Oklahoma Identity Theft Passport Program § 375:40-1-1 thru § 375:40-1-11	http://www.oar.state.ok.us/oar/codedoc02.nsf/All/0941DE046451FFD3862575F400119991?OpenDocument	
308	Oklahoma State Law Disclosure of breach of security of computerized personal information, §74-3113.1	http://www2.lsb.state.ok.us/os/os_74-3113.1.rtf	
309	OMB Circular A-123 Management’s Responsibility for Internal Control	http://www.whitehouse.gov/OMB/circulars/a123/a123_rev.html	
310	Oregon Consumer Identity Theft Protection Act, Senate Bill 583	http://www.leg.state.or.us/07reg/measpdf/sb0500.dir/sb0583.b.pdf	
311	Oregon Revised Statutes Chapter 646a § 646A.600 thru § 646A.624 Identity Theft Protection Act	http://www.leg.state.or.us/ors/646a.html	
312	ORGANIC LAW 15/1999 of 13 December on the Protection of Personal Data	https://www.agpd.es/upload/Ley%20Org%E1nica%2015-99_ingles.pdf	
313	Payment Card Industry (PCI) Data Security Standard Security Audit Procedures	https://www.pcisecuritystandards.org/pdfs/pci_audit_procedures_v1-1.pdf	
314	Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance No Electronic Storage, Processing, or Transmission of Cardholder Data	https://www.pcisecuritystandards.org/docs/pci_saq_a.doc	
315	Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire B and Attestation of Compliance Imprint Machines or Stand-alone Dial-out Terminals Only, no Electronic Cardholder Data 	https://www.pcisecuritystandards.org/docs/pci_saq_b.doc	
316	Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire C and Attestation of Compliance Payment Application Connected to Internet, No Electronic Cardholder Data Storage	https://www.pcisecuritystandards.org/docs/pci_saq_c.doc	
317	Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance All other Merchants and all SAQ-Eligible Service Providers	https://www.pcisecuritystandards.org/docs/pci_saq_d.doc	
318	Payment Card Industry (PCI) Data Security Standard, Requirements and Security Assessment Procedures	https://www.pcisecuritystandards.org/security_standards/pci_dss_download_agreement.html	
319	Payment Card Industry (PCI) Payment Application Data Security Standard	https://www.pcisecuritystandards.org/pdfs/pci_pa-dss_security_audit_procedures_v1-1.pdf	
320	Payment Card Industry Self-Assessment Questionnaire A and Attestation of Compliance No Electronic St	https://www.pcisecuritystandards.org/docs/saq_a_v1-1.doc	
321	Payment Card Industry Self-Assessment Questionnaire B and Attestation of Compliance Imprint Machines	https://www.pcisecuritystandards.org/docs/saq_b_v1-1.doc	
322	Payment Card Industry Self-Assessment Questionnaire C and Attestation of Compliance Payment Applicat	https://www.pcisecuritystandards.org/docs/saq_c_v1-1.doc	
323	Payment Card Industry Self-Assessment Questionnaire D and Attestation of Compliance All Other Merch	https://www.pcisecuritystandards.org/docs/saq_d_v1-1.doc	
324	PCAOB Auditing Standard No. 2	http://www.pcaobus.org/Rules/Rules_of_the_Board/Auditing_Standard_2.pdf	
325	PCAOB Auditing Standard No. 3	http://www.pcaobus.org/Rules/Rules_of_the_Board/Auditing_Standard_3.pdf	
326	PCAOB Auditing Standard No. 5	http://www.pcaobus.org/Rules/Rules_of_the_Board/Auditing_Standard_5.pdf	
327	PCI DSS (Payment Card Industry Data Security Standard)	https://www.pcisecuritystandards.org/security_standards/pci_dss_download_agreement.html	
328	PCI DSS Security Scanning Procedures	https://www.pcisecuritystandards.org/pdfs/pci_scanning_procedures_v1-1.pdf	
329	Pennsylvania Statutes Title 73 – Trade and Commerce Chapter 43 – Breach of Personal Information Notification Act § 2301 thru § 2329	http://www.schwartzandballen.com/ImportedLawsBills/Pennsylvania%20Security%20Breach.pdf	
330	Performance Measurement Guide for Information Security, NIST 800-55 Rev. 1	http://csrc.nist.gov/publications/nistpubs/800-55-Rev1/SP800-55-rev1.pdf	
331	Poland Protection of Personal Data Act	http://www.giodo.gov.pl/plik/id_p/61/j/en/	
332	Portuguese Act on the Protection of Personal Data 67/98	http://www.cnpd.pt/english/bin/legislation/Law6798EN.HTM	
333	Protection of Assets Manual, ASIS International	http://www.protectionofassets.com/	
334	Puerto Rico Code Title 10 Subtitle 3 Chapter Citizen Information on Data Banks Security Act, 10 L.P.R.A. § 4051	http://www.schwartzandballen.com/ImportedDocs/Puerto%20Rico%20security%20breach.pdf	
335	Recommended Security Controls for Federal Information Systems, NIST SP 800-53	http://csrc.nist.gov/publications/nistpubs/800-53-Rev2/sp800-53-rev2_pdf.zip	
336	Responsible Care Security Code of Management Practices, American Chemistry Council	http://www.americanchemistry.com/securitycode_pdf	
337	Revised Code of Washington Title 19 Chapter 19.215 Disposal of personal information § 19.215.005 thru § 19.215.030	http://apps.leg.wa.gov/RCW/default.aspx?cite=19.215	
338	Revised Code of Washington Title 19 Chapter 19.255 Personal information - notice of security breaches § 19.255.010	http://apps.leg.wa.gov/RCW/default.aspx?cite=19.255.010	
339	Rhode Island General Law Chapter 11-49.2 Identity Theft Protection § 11-49.2-1 thru § 11-49. 2-4	http://www.rilin.state.ri.us/statutes/TITLE11/11-49.2/INDEX.HTM	
340	Rhode Island Security Breach Notification Law, RI HB 6191	http://www.rilin.state.ri.us/Billtext/BillText05/HouseText05/H6191.pdf	
341	Risk Management Guide for Information Technology Systems, NIST SP 800- 30	http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf	
342	SAS 109, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement	http://www.aicpa.org/download/members/div/auditstd/AU-00314.PDF	
343	SAS 110, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained	http://www.aicpa.org/download/members/div/auditstd/AU-00318.PDF	
344	Securities Act of 1933	http://uscode.house.gov/download/pls/15C2A.txt	
345	Securities Exchange Act of 1934	http://uscode.house.gov/download/pls/15C2B.txt	
346	Security Considerations in the Information System Development Life Cycle, NIST SP 800-64	http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64-Revision2.pdf	
347	Security Metrics Guide for Information Technology Systems, NIST SP 800-55	http://csrc.nist.gov/publications/nistpubs/800-55/sp800-55.pdf	
348	Security Self-Assessment Guide, NIST SP 800-26	http://csrc.nist.gov/publications/nistpubs/800-26/sp800-26.pdf	
349	Slovak Republic Protection of Personal Data in Information Systems	http://www.dataprotection.gov.sk/buxus/docs/act_428.pdf	
350	Smith Guidance on Audit Committees, UK FRC	http://www.frc.org.uk/documents/pagemanager/frc/The%20Smith%20Guidance%20on%20Audit%20Committees%20June%202006.pdf	
351	South Carolina Code of Laws § 1-11-490 Breach of security of state agency data notification	http://www.scstatehouse.gov/code/t01c011.htm	
352	South Carolina Code of Laws § 16-13-512 Credit Card and § 39-1-90 Breach of security of business data notification	http://www.scstatehouse.gov/code/t39c001.htm	
353	State of Arizona Standard P800-S880, Revision 2.0: Media Sanitation/Disposal	http://www.azgita.gov/policies_standards/pdf/P800-S880%20Media%20San+Disp.pdf	
354	State Prohibitions on Marketing Practices using Medical Information (CA SB1633)	http://info.sen.ca.gov/cgi-bin/postquery?bill_number=sb_1633&amp;sess=0304&amp;house=B&amp;site=sen	
355	Sweden Personal Data Act (1998:204)	http://www.sweden.gov.se/content/1/c6/01/55/42/b451922d.pdf	
356	Swedish Code of Corporate Governance; A Proposal by the Code Group	http://www.sweden.gov.se/download/f8334504.pdf?major=1&amp;minor=26296&amp;cn=attachmentPublDuplicator_0_attachment	
357	Switzerland Federal Act on Data Protection	http://www.dataprotection.eu/pmwiki/pmwiki.php?n=Main.CH	
358	System Security Plan (SSP) Procedure	http://www.cms.hhs.gov/informationsecurity/downloads/SSP_Procedure.pdf	
359	Taiwan Computer-Processed Personal Data Protection Law 1995	http://www.ics.uci.edu/~kobsa/privacy/Taiwan1.htm	
360	Technology Risk Management Guide for Bank Examiners – OCC Bulletin 98-3	http://www.occ.treas.gov/ftp/bulletin/98-3.txt	
361	Tennessee Code Title 47 Chapter 18 Part 21 Identity Theft Deterrence § 47-18-2101 thru § 47-18-2110	http://www.michie.com/tennessee/lpext.dll?f=templates&amp;fn=main-h.htm&amp;cp=tncode	
362	Tennessee Security Breach Notification, TN SB 2220	http://tennessee.gov/sos/acts/104/pub/pc0473.pdf 	
363	Texas Business and Commerce Code, secs. 48.102, 48.103	http://www.hro.house.state.tx.us/PDF/ba80r/HB3222.PDF	
364	Texas Business and Commercial Code Title 11, Subtitle B, Chapter 521 Subchapter A § 521	http://www.statutes.legis.state.tx.us/Docs/BC/pdf/BC.521.pdf	
365	Texas Identity Theft Enforcement and Protection Act, TX SB 122	http://www.bakers-legal-pages.com/leg2005/bills/sb00122f.htm	
366	The DIRKS Manual: A Strategic Approach to Managing Business Information	http://www.naa.gov.au/records-management/publications/dirks-manual.aspx	
367	The Dutch corporate governance code, Principles of good corporate governance and best practice provisions	http://www.ecgi.org/codes/documents/cg_code_nl_en.pdf	
368	The GAIT Methodology	http://www.theiia.org/guidance/standards-and-guidance/ippf/practice-guides/gait/gait-m/	
369	The King Committee on Corporate Governance, Executive Summary of the King Report 2002	http://www.ecgi.org/codes/documents/executive_summary.pdf	
370	The National Strategy to Secure Cyberspace	http://www.dhs.gov/xlibrary/assets/National_Cyberspace_Strategy.pdf	
371	The Sarbanes-Oxley Act of 2002	http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=107_cong_bills&amp;docid=f:h3763enr.tst.pdf	
372	The Sedona Principles Addressing Electronic Document Production	http://www.thesedonaconference.org/dltForm?did=7_05TSP.pdf	
373	The Standard of Good Practice for Information Security	https://www.isfsecuritystandard.com/SOGP07/index.htm	
374	TITLE 49, Subtitle VII - Aviation Programs	http://www.tsa.gov/assets/pdf/49_USC_Chapters_401_to_501.pdf	
375	Transportation Security Administration (TSA) Security Guidelines for General Aviation Airports, Information Publication A-001, May 2004	http://www.tsa.gov/assets/pdf/security_guidelines_for_general_aviation_airports.pdf	
376	Turnbull Guidance on Internal Control, UK FRC	http://www.frc.org.uk/documents/pagemanager/frc/Revised%20Turnbull%20Guidance%20October%202005.pdf	
377	UK Data Protection Act of 1998	http://www.opsi.gov.uk/acts/acts1998/ukpga_19980029_en_1	
378	UN Guidelines for the Regulation of Computerized Personal Data Files (1990)	http://www.worldlii.org/int/other/PrivLRes/1990/1.html	
379	Underlying Technical Models for Information Technology Security, SP 800-33	http://csrc.nist.gov/publications/nistpubs/800-33/sp800-33.pdf	
380	Uniform Electronic Transactions Act (UETA) (1999)	http://www.law.upenn.edu/bll/ulc/fnact99/1990s/ueta99.htm	
381	Uniform Rules of Evidence Act	http://www.law.upenn.edu/bll/ulc/ure/evid1200.htm	
382	US Department of Commerce EU Safe Harbor Privacy Principles	http://www.export.gov/safeharbor/index.asp	
383	US Department of Energy Cyber Security Program Media Clearing, Purging, and Destruction Guidance: DOE CIO Guidance CS-11	http://cio.energy.gov/CS-11_Clearing_and_Media_Sanitization_Guidance.pdf	
384	US Export Administration Regulations Database	http://www.gpo.gov/bis/ear/ear_data.html	
385	US The International Traffic in Arms Regulations	http://www.pmddtc.state.gov/regulations_laws/itar_official.html	
386	Utah Protection of Personal Information Act, Utah Code § Title 13-44. Protection of Personal Information Act	http://le.utah.gov/~code/TITLE13/13_44.htm	
387	Vermont Relating to Identity Theft , VT HB 327	http://www.leg.state.vt.us/docs/legdoc.cfm?URL=/docs/2004/acts/ACT155.HTM	
388	Vermont Statute Title 9 Chapter 62 Protection of Personal Information § 2430, § 2435, § 2440, § 2445	http://www.leg.state.vt.us/statutes/fullchapter.cfm?Title=09&amp;Chapter=062	
389	Virgin Islands Code Tittle 14 Chapter 110 The Identity Theft Prevention Act § 2201 thru § 2211	http://www.michie.com/virginislands/lpext.dll?f=templates&amp;fn=main-h.htm&amp;cp=vicode	
390	Virginia Code Title 18.2 Chapter 6 Breach of personal information notification § 18.2-186.6	http://leg1.state.va.us/000/cod/18.2-186.6.HTM	
391	Virginia Identity theft; penalty; restitution; victim assistance, VA HB 872	http://leg1.state.va.us/cgi-bin/legp504.exe?041+ful+CHAP0450	
392	VISA CISP: What to Do If Compromised Visa Fraud Control and Investigation Procedures	http://usa.visa.com/download/merchants/cisp_what_to_do_if_compromised.pdf	
393	Visa Data Field Encryption	http://corporate.visa.com/_media/best-practices.pdf	
394	VISA E-Commerce Merchants Guide to Risk Management Tools and Best Practices for Building a Secure Internet Business	http://usa.visa.com/download/merchants/visa_risk_management_guide_ecommerce.pdf	
395	VISA Incident Response Procedure for Account Compromise	http://www.visa-asia.com/ap/center/merchants/riskmgmt/includes/uploads/VisaAP_Inc_Resp_Procedv1_2_2004.pdf	
396	Visa Payment Application Best Practices (PABP)	http://usa.visa.com/download/merchants/cisp_payment_application_best_practices.doc	
397	Washington DC Consumer Personal Information Security Breach Notification Act of 2006	http://www.dccouncil.washington.dc.us/images/00001/20061218135855.pdf	
398	Washington Notice of a breach of the security, WA SB 6043	http://www.leg.wa.gov/pub/billinfo/2005-06/Htm/Bills/Senate%20Bills/6043-S.htm	
399	West Virginia Code Chapter 46A Article 2A Breach of Security of Consumer Information § 46A-2A-101 thru § 46A-2A-105	http://www.legis.state.wv.us/WVCODE/Code.cfm?chap=46a&amp;art=2A#2A	
400	Wisconsin Act 138 Notice of unauthorized acquisition of personal information	http://www.legis.state.wi.us/2005/data/acts/05act138.pdf	
401	Wisconsin Statute Chapter 134 Notice of unauthorized acquisition of personal information § 134.98	www.legis.state.wi.us/statutes/Stat0134.pdf	
402	Wyoming Statute Title 40 Article 5 Breach of the security of the data system § 40-12-501 thru § 40-12-509	http://legisweb.state.wy.us/statutes/statutes.aspx?file=titles/Title40/Title40.htm