Summary

This is the first chapter where we started to look at compliance. In this chapter we looked at compliance issues that will be faced by companies in almost any industry. We started off looking at Sarbanes-Oxley and moved on to ISO 27000 that defines the Security Management System Requirements, and then on to COBIT that defines control objectives for Information Technology. Aspects of all three of these regulations fit very well as a perspective in the eGRCM application. Next, we looked at the California Breach Law, HIPPA, and Payment Card Industry regulations. These have the common theme of privacy and we showed Oracle capabilities for hiding, encrypting, and masking values. We rounded out our examination of cross industry compliance by looking at federal sentencing guidelines and showed how a learning management solution provides a defensible position and demonstrates due diligence.