US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule HE-3: FSA compliance requirements

What else in your programme already covers this

This control maps to 77 controls across 64 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

MTCS (Singapore) · 2 controls

MTCS-Governance-ISMS-Risk-HR-Lifecycle-Compliance-Cloud-Strategy-Roles-Responsibilities MTCS Governance + ISMS + Risk Management + HR Security + Cloud Service Lifecycle + Compliance + Roles
MTCS-Scope-SS-584-Singapore-Standards-Council-IMDA-SAC-3-Tier-2013-2015-2020-2024-Certification MTCS Scope + SS 584 + Singapore Standards Council + IMDA + SAC + 3-Tier Framework + Certification

Nebraska Data Privacy Act · 2 controls

NDPA-1 Applicability, Scope, and Carve-Outs
NDPA-8 Nebraska Attorney General Enforcement, Permanent 30-Day Cure, and Penalties

Nigeria Data Protection Act 2023 (NDPA) · 2 controls

NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
NG-NDPA-8 Enforcement, Penalties, Data Controllers of Major Importance (DCMI), and Compliance

SASB Standards · 2 controls

SASB-3 Leadership and Governance (LG)
SASB-LG-1 Business Ethics

Bahrain PDPL · 1 control

BH-PDPL-25 Compliance monitoring and auditing

FedRAMP High · 1 control

AC-2 Account Management

FedRAMP Moderate · 1 control

AC-2 Account Management

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

UAE-PDPL-Status UAE PDPL status, executive regulations, UAE Data Office guidance evolution

IEEE 7000 · 1 control

IEEE7000-Scope-VBE-EAD-IEEE7000Family-EUAIAct-NIST-ISO42001-Coord IEEE 7000-2021 - Scope + Value-Based Engineering (VBE) + Ethically Aligned Design + IEEE 7000 Family + Coordination EU AI Act + NIST AI RMF + ISO/IEC 42001

ISMAP (Japan) · 1 control

ISMAP-CloudGovernance-ISMS-RiskAssessment-SharedResponsibility-Policy-RegulatoryCompliance-RolesResponsibilities ISMAP Cloud Governance - ISMS per ISO 27001/JIS Q 27001 + Risk Assessment + Shared Responsibility Model + Cloud Security Policy + Regulatory Compliance + Roles and Responsibilities

ISO 14001 · 1 control

ISO14001-03 Legal and regulatory compliance obligations

ISO 22000 · 1 control

ISO22000-03 Legal and regulatory compliance

ISO 27017 · 1 control

ISO27017-04 Regulatory compliance for cloud services

ISO 27018 · 1 control

ISO27018-04 Regulatory compliance for cloud services

ISO 45001 · 1 control

ISO45001-03 Legal and regulatory compliance

ISSB Standards · 1 control

ISSB-IFRS-S1-Sources-SASB-Industry-Disclosures-Connected-Information-Reporting-Boundary ISSB IFRS S1 Sources of Guidance + SASB Standards Industry-Specific Disclosures + Connected Information + Reporting Boundary + Time of Reporting + Comparative Information + 11 SASB Sectors

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 1 control

ICELAND-Act90-Chap6-Personuvernd-Enforcement-AdminFines-AAB-Appeals-CriminalPenalties Iceland Act 90/2018 - Chapter VI Personuvernd Authority + Investigation + Administrative Fines + Penal Code Section 228 + Court Appeals

Indiana Consumer Data Protection Act · 1 control

INCDPA-Enforcement-30DayCure-AttorneyGeneralOnly-NoPrivateRight-CivilPenalties-7500-PerViolation Indiana CDPA Enforcement - Attorney General Exclusive + 30-Day Cure Period + No Private Right of Action + Civil Penalties Up to USD 7500 Per Violation + Investigation + Compliance

Indonesia PDP Law · 1 control

IDPdp-Enforcement-Sanctions-Administrative-Criminal-Art56to69-DPAgency-Fine-Imprisonment-IDR6bn Indonesia PDP Articles 57-73 + Enforcement + Administrative Sanctions + Criminal Sanctions + Fines IDR Up to 6 Billion + Imprisonment Up to 6 Years + DPA Investigation + Damages Claims + Prohibitions

Iowa Consumer Data Protection Act · 1 control

ICDPA-Enforcement-90DayCure-AttorneyGeneralOnly-NoPrivateRight-CivilPenalties-7500-PerViolation-Longest-Cure Iowa CDPA Enforcement - Attorney General Exclusive + 90-Day Cure Period (LONGEST among US State Privacy Laws) + No Private Right of Action + Civil Penalties Up to USD 7500 Per Violation

Jamaica Data Protection Act 2020 · 1 control

JM-DPA2020-Complaints-Enforcement-Sec45-50-Investigation-Hearing-Determination-Appeal-Tribunal Jamaica DPA 2020 Complaints + Enforcement + Sections 45-50 + Complaint Procedure + Investigation + Hearing + Determination + Compliance Orders + Administrative Penalties + Data Protection Tribunal + High Court Appeals

Japan AI Guidelines · 1 control

JP-AIG-Accountability-Governance-AI-Inventory-Stakeholder-Engagement-Board-Reporting-Tone-at-Top Japan AI Guidelines Accountability + Governance + AI Inventory + Stakeholder Engagement + Board Reporting + Tone at Top + AI Ethics Committee + DPO + AI Officer + Regulatory Compliance + Multi-Stakeholder

Kentucky Consumer Data Protection Act · 1 control

KY-CDPA-Attorney-General-AG-Enforcement-Sole-30-Day-Cure-Period-7500-Civil-Penalty-Per-Violation Kentucky CDPA Attorney General Enforcement + Sole Authority + 30-Day Cure Period + USD 7,500 Civil Penalty Per Violation + No Private Right of Action + Injunctive Relief + Attorneys' Fees + Section 9 Enforcement + Children's Data + Sensitive Data Heightened

LGPD · 1 control

LGPD-BR-Enforcement-Sanctions-ANPD-Article-52-55-Administrative-Sanctions-2-Percent-Turnover-50M-BRL Brazil LGPD Enforcement + Sanctions + Article 52 + 2% Turnover + 50M BRL + ANPD

Liechtenstein DPA · 1 control

LIDPA-Enforcement-Sanctions-Articles-50-65-DSS-Administrative-Fines-20M-EUR-4-Percent-Cooperation-Codes-Certification Liechtenstein DPA Enforcement + Articles 50-65 + Administrative Fines EUR 20M + 4%

Malaysia PDPA 2010 · 1 control

MY-PDPA-Enforcement-PDPC-Investigation-RM1M-Fine-3-Year-Prison-Class-Action-Section-104-2024-Amendment Malaysia PDPA Enforcement + PDPC Investigation + RM1M Fine + 3 Year Prison + Class Action + 2024 Amendment

Maryland Online Data Privacy Act of 2024 · 1 control

MD-MODPA-Enforcement-Maryland-AG-Brown-CPD-Section-14-4613-10K-Per-Violation-Consumer-Protection-Act Maryland MODPA Enforcement + Maryland AG + CPD + Section 14-4613 + USD 10K Per Violation + Consumer Protection Act

Mauritius DPA · 1 control

MU-DPA-Enforcement-Commissioner-Section-41-43-MUR-200K-5-Year-Prison-ICT-Appeal-Tribunal-Supreme-Court Mauritius DPA Enforcement + Commissioner + Section 41 + Section 43 + MUR 200K + 5 Year Prison + ICT Appeal Tribunal + Supreme Court

Mexico LFPDPPP · 1 control

MX-LFPDPPP-Enforcement-INAI-Articles-63-64-67-320K-Days-Minimum-Wage-3-Year-Prison-TFJA-Recurso-Revision-SCJN Mexico LFPDPPP Enforcement + INAI + Articles 63-64-67 + 320K Days Minimum Wage + 3 Year Prison + TFJA + Recurso de Revision + SCJN

Minnesota Consumer Data Privacy Act · 1 control

MN-CDPA-Processor-Contract-Security-Section-325O-08-Pseudonymisation-Section-325O-09-De-Identification Minnesota CDPA Processor + Section 325O.08 + Security + Pseudonymisation + Section 325O.09 + De-Identification

Montana Consumer Data Privacy Act · 1 control

MT-CDPA-Processor-Contract-Security-MCA-30-14-2809-30-14-2811-Pseudonymisation-De-Identification Montana CDPA Processor + MCA 30-14-2809 + Security + Pseudonymisation + MCA 30-14-2811 + De-Identification

NIST Privacy Framework · 1 control

NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment

NIST SP 800-122 · 1 control

NISTSP122-8 Continuous Monitoring, Training, and Privacy Programme Governance

NIST SP 800-144 · 1 control

NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation

NIST SP 800-145 · 1 control

NISTSP145-1 On-Demand Self-Service and Broad Network Access Characteristics

NIST SP 800-146 · 1 control

NISTSP146-6 Cloud Security and Privacy Recommendations

NIST SP 800-190 · 1 control

NIST190-04 Regulatory compliance for cloud services

NIST SP 800-53 Rev 5 LOW · 1 control

AC-2 Account Management

NIST SP 800-53 Rev 5 MODERATE · 1 control

AC-2 Account Management

NIST SP 800-53 Revision 5.1 HIGH · 1 control

AC-2 Account Management

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 1 control

NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management

New Hampshire Data Privacy Act · 1 control

NHPA-8 AG Formella Enforcement, Permanent 60-Day Cure, and Penalties

New Jersey Data Privacy Act · 1 control

NJDPA-8 AG Platkin Enforcement, 18-Month Cure Sunset, and Division of Consumer Affairs

New Zealand Information Security Manual (NZISM) · 1 control

NZISM-2 Certification and Accreditation (C&A) for Government Systems

Nigeria Data Protection Regulation (NDPR) · 1 control

NGNDPR-8 Annual Data Protection Audit, Penalties, and NDPA Transition

OECD AI Principles · 1 control

OECDAI-8 AI Incident Reporting, Regulatory Compliance, Public Reporting, and International Cooperation

Oregon Consumer Privacy Act · 1 control

OREGONCPA-8 Cure Period, Attorney General Enforcement, Training, Compliance Monitoring

PDPA Singapore · 1 control

PDPASG-7 Retention Limitation, Do Not Call, Compliance, Complaints

PDPA Thailand · 1 control

PDPATH-7 DPO, Records of Processing, Retention, Marketing, Training

POPIA · 1 control

POPIASA-8 Information Regulator Cooperation, Complaints, Enforcement

Personal Data Act (personopplysningsloven) · 1 control

NORWAY-7 DPO, Cooperation with Datatilsynet, Retention, Marketing, Training

Privacy Act 2020 · 1 control

NZPRV-8 Privacy Officer, OPC Cooperation, Compliance Notices, Complaints, Training

Qatar DPL · 1 control

QATAR-7 DPO, Records, Retention, Marketing, Training

Saudi Arabia PDPL · 1 control

SA-PDPL-25 Compliance monitoring and auditing

South Korea PIPA · 1 control

PIPA-Pseudonymisation-Article-28-2-3-Enforcement-PIPC-Investigation-Surcharges-3-Percent-Revenue-Article64-2 Korea PIPA Pseudonymisation + Article 28-2 + Enforcement + PIPC + Surcharges 3% + Article 63 + 64-2

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

CH-FADP-25 Compliance monitoring and auditing

TCFD Recommendations · 1 control

TCFDREC-1 Governance - Board Oversight, Management Role

Taiwan PDPA · 1 control

TAIWAN-4 DPIA, Privacy by Design

Texas Data Privacy Act · 1 control

TEXASTDPSA-3 Sensitive Data, Children, Sale Notice

Turkey KVKK · 1 control

TURKEYKVKK-3 Special Categories and Sensitive Data

UK AI Regulation Framework · 1 control

UKAI-2 Sector-Specific Regulator Engagement

Uruguay DPL · 1 control

URUGUAY-5 Database Registration with AGESIC URCDP

Vietnam PDPD · 1 control

VIETNAMPDP-3 Data Subject Rights

Virginia CDPA · 1 control

VIRGINIAVCDPA-4 Privacy Notice and DPIA

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.