Computer Fraud and Abuse Act (CFAA): Federal law that prohibits accessing a computer without authorization or exceeding authorized access. Critical for ensuring VAPT activities are properly authorized and within scope.
Electronic Communications Privacy Act (ECPA): Extends restrictions on wiretaps to include transmitted electronic data. Relevant for network penetration testing and monitoring activities.
Federal Information Security Management Act (FISMA): Sets security standards for federal information systems. Important for VAPT policies involving government systems or contractors.
Federal Trade Commission Act (FTC Act): Prohibits unfair or deceptive practices affecting commerce. Relevant for ensuring VAPT activities don't compromise consumer data protection.
HIPAA: Healthcare privacy law requiring protection of patient health information. Critical for VAPT in healthcare environments.
GLBA (Gramm-Leach-Bliley Act): Requires financial institutions to explain information-sharing practices and protect sensitive data. Important for financial sector VAPT.
PCI DSS: Payment Card Industry Data Security Standard governing payment card data security. Mandatory consideration for VAPT involving payment systems.
Sarbanes-Oxley Act (SOX): Requires public companies to establish internal controls and report on their effectiveness. Relevant for VAPT in public companies.
State Data Breach Notification Laws: Various state laws requiring notification of security breaches. Must be considered in VAPT incident response procedures.
CCPA (California Consumer Privacy Act): California's comprehensive privacy law, representing the strictest state-level privacy requirements. Important model for VAPT data handling.
NIST SP 800-115: Technical Guide to Information Security Testing and Assessment. Provides framework and methodology for security testing.
NIST Cybersecurity Framework: Voluntary guidance for private sector organizations to better manage and reduce cybersecurity risk. Important for VAPT methodology.
ISO 27001: International standard for information security management. Provides framework for VAPT policy development and implementation.
