The Bank Secrecy Act of 1970 (or BSA, or otherwise known as the Currency and Foreign Transactions Reporting Act) requires U.S.A. financial institutions to assist U.S. government agencies to detect and prevent money laundering. Specifically, the act requires financial institutions to keep records of cash purchases of negotiable instruments, file reports of cash transactions exceeding $10,000 (daily aggregate amount), and to report suspicious activity that might signify money laundering, tax evasion, or other criminal activities. It was passed by the Congress of the United States in 1970. The BSA is sometimes referred to as an "anti-money laundering" law ("AML") or jointly as “BSA/AML”. Several anti-money laundering acts, including provisions in title III of the USA PATRIOT Act, have been enacted up to the present to amend the BSA. (See 31 USC 5311-5330 and 31 CFR 103.)

• 31 U.S.C. 5311-5314e
• 5316-5330
• 5331
• 5332e
• 12 U.S.C. 1829b
• 12 U.S.C. 1951-1959e

• 31 CFR part 103

The Federal Register contains final regulations issued after the date of codification, as well as the Notices of Proposed Rulemaking.

The Food and Drug Administration (FDA) is an agency of the United States Department of Health and Human Services and is responsible for regulating food (humans and animal), dietary supplements, drugs (human and animal), cosmetics, medical devices (human and animal) and radiation emitting devices (including non-medical devices), biologics, and blood products in the United States.

Authorization and mandate
The FDA derives its authority and jurisdiction from various Congressional acts. The main source of the FDA's authority is the Federal Food, Drug, and Cosmetic Act. Additionally, as a Federal agency, the FDA is required by Executive orders 13132 to review all proposed new rules for Federalism issues.

The main purpose of the FDA is to protect citizens from products that are inherently unsafe or that make claims of effectiveness that cannot be substantiated. Because of the vast number of products or substances that may affect the public and the expertise required to evaluate them, Congress delegates this task to a specilized administrative agency.

The FDA thus has the power to regulate a multitude of products in a manner that ensures the safety of the American public and the effectiveness of marketed food, medical, and cosmetic products. Regulations may take several forms, including but not limited to outright ban, controlled distribution, and controlled marketing. Additionally, the FDA sets the standards under which individuals may be licensed to prescribe drugs or other medical devices. Regulatory enforcement is carried out by Consumer Safety Officers within the Office of Regulatory Affairs and criminal matters are handled by special agents within the Office of Criminal Investigations (OCI).

Citizen's Petitions
Anyone can request or petition the FDA to change or create an Agency policy or regulation through the Citizen's Petition process. 21 CFR Part 10.30. [1]. Despite the name, this process is primarily used by companies seeking a change to an FDA policy.

Political susceptibility
Since the FDA derives its authority from enabling legislation, it is principally a delegate of Congress to handle the large number of detailed issues related to its authority. As such, it at any time may be redirected, reorganized or even dissolved at the discretion of Congress. This puts the purpose of the FDA at risk with any change in the balance of power in Congress.

In addition to direct control over the agency's charter, Congress has leverage over the FDA's operations by means of budget allocation. Since budgetary legislation and amendments are very common and many times have a "must pass" status, this method of control is much easier to implement than to gain the wide agreement by Congress to modify the charter of an agency.

Additionally, the FDA's Commissioner is nominated by the President and confirmed by the Senate. This allows the President to select Commissioners who may be sympathetic to political issues he deems important. Additionally Senate rules allow for nominations to be blocked by means of filibuster, whereby the Senate must first obtain a super-majority of 60% to close debate on an issue before vote.

Finally, the Commissioner himself has discretion regarding the staff employees within the agency and has the power to influence their decisions simply by being able to dismiss those who are not aligned with his views.

Jurisdiction
The FDA does not pre-approve dietary supplements on their safety and efficacy, unlike drugs. In contrast, the FDA can only go after dietary supplement manufacturers after they have put unsafe products on the market. However, certain foods (such as infant formula and medical foods) are deemed special nutritional because they are consumed by highly vulnerable populations and are thus regulated more strictly than the majority of dietary supplements.

Under former Commissioner David Aaron Kessler the FDA in the 1990's attempted to regulate tobacco as a pharmaceutical. The courts determined in FDA v. Brown & Williamson Tobacco Corp. that the FDA did not have Congressional authority to regulate tobacco.

The official title of the USA PATRIOT Act is "Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act of 2001." To view this law in its entirety, click on the USA PATRIOT Act link below.

The purpose of the USA PATRIOT Act is to deter and punish terrorist acts in the United States and around the world, to enhance law enforcement investigatory tools, and other purposes, some of which include:

• To strengthen U.S. measures to prevent, detect and prosecute international money laundering and financing of terrorism;
• To subject to special scrutiny foreign jurisdictions, foreign financial institutions, and classes of international transactions or types of accounts that are susceptible to criminal abuse;
• To require all appropriate elements of the financial services industry to report potential money laundering;
• To strengthen measures to prevent use of the U.S. financial system for personal gain by corrupt foreign officials and facilitate repatriation of stolen assets to the citizens of countries to whom such assets belong.

Below is a brief, non-comprehensive overview of the sections of the USA PATRIOT Act that may affect financial institutions.

Section 311: Special Measures for Jurisdictions, Financial Institutions, or International Transactions of Primary Money Laundering Concern

This Section allows for identifying customers using correspondent accounts, including obtaining information comparable to information obtained on domestic customers and prohibiting or imposing conditions on the opening or maintaining in the U.S. of correspondent or payable-through accounts for a foreign banking institution.

• Listed Rulemaking

Section 312: Special Due Diligence for Correspondent Accounts and Private Banking Accounts

This Section amends the Bank Secrecy Act by imposing due diligence & enhanced due diligence requirements on U.S. financial institutions that maintain correspondent accounts for foreign financial institutions or private banking accounts for non-U.S. persons.

• Special Due Diligence Programs for Certain Foreign Accounts

Section 313: Prohibition on U.S. Correspondent Accounts with Foreign Shell Banks

To prevent foreign shell banks, which are generally not subject to regulation and considered to present an unreasonable risk of involvement in money laundering or terrorist financing, from having access to the U.S. financial system. Banks and broker-dealers are prohibited from having correspondent accounts for any foreign bank that does not have a physical presence in any country. Additionally, they are required to take reasonable steps to ensure their correspondent accounts are not used to indirectly provide correspondent services to such banks.

This article or section deals primarily with the United States and does not present a worldwide view of the subject.

Continuity of Government (COG) is the principle of establishing defined procedures that allow a government to continue its essential operations in case of a nuclear war or other catastrophic event. Developed during the Cold War, COG plans were implemented by many countries to avoid leaving a vacuum at any governmental level, which could lead to anarchy or to an unlawful assumption of authority. Effectively the democratic process is revoked temporarily until the effects of the event have subsided and normal government can resume. It is not a generally published part of government policy and is generally shrouded in secrecy for security reasons.

Continuity of Government in the United States
The main points of such a plan in the United States are to suspend certain parts of the United States Constitution and to allow the alternative use of federal land and buildings (including use as internment camps) by FEMA for the housing/detention of US citizens as required, as well as any rescue/recovery operations. It also allows for power in the US to be centralized to the White House and "appointment of military commanders to run state and local governments and declaration of martial law". In the former regard the United States arrangements for Continuity of Government are unusual. The plans in most countries are intended to preserve the legal and constitutional framework, the American system relies on circumventing it. There is no legal basis for the imposition of so-called "martial law".

House Democrat Jack Brooks brought up the issue during the Iran-Contra Affair hearings. Try as he might, he was not able to get the answers to his questions from Col. Oliver North, (it had been reported in the Miami Herald that North had worked on such plans) as he was repeatedly requested by the Chairman to refrain from discussing the issue and to request for a (non-public) executive session if he wanted to discuss the issue at all.

Apparently the Legislative and Judiciary Branches pf the US Government each have similar continuity plans. However, both require the Executive to notify them before they are activated. There appears to have been no notification following 9-11 to either the Congress or US Supreme Court until it was finally admitted to Congress in 2002.

The Health Insurance Portability and Accountability Act (HIPAA) was enacted by the U.S. Congress in 1996. According to the Centers for Medicare and Medicaid Services' (CMS) website, Title I of HIPAA protects health insurance coverage for workers and their families when they change or lose their jobs.

Title II of HIPAA, the Administrative Simplification (AS) provisions, requires the establishment of national standards for electronic health care transactions and national identifiers for providers, health insurance plans, and employers.
The AS provisions also address the security and privacy of health data. The standards are meant to improve the efficiency and effectiveness of the nation's health care system by encouraging the widespread use of electronic data interchange in the US health care system.

Title I: Health Care Access, Portability, and Renewability
Title I of HIPAA regulates the availability and breadth of group and individual health insurance plans. It amends both the Employee Retirement Income Security Act and the Public Health Service Act.

Title I prohibits any group health plan from creating eligibility rules or assessing premiums for individuals in the plan based on health status, medical history, genetic information, or disability. This does not apply to private individual insurance.

Title I also limits restrictions that a group health plan can place on benefits for preexisting conditions. Group health plans may refuse to provide benefits relating to preexisting conditions for a period of 12 months after enrollment in the plan or 18 months in the case of late enrollment. However, individuals may reduce this exclusion period if they had health insurance prior to enrolling in the plan. Title I allows individuals to reduce the exclusion period by the amount of time that they had "creditable coverage" prior to enrolling in the plan and after any "significant breaks" in coverage. "Creditable coverage" is defined quite broadly and includes nearly all group and individual health plans, Medicare, and Medicaid. A "significant break" in coverage is defined as any 63 day period without any creditable coverage.

To illustrate, suppose someone enrolls in a group health plan on January 1, 2006. This person had previously been insured from January 1, 2004 until February 1, 2005 and from August 1, 2005 until December 31, 2005. To determine how much coverage can be credited against the exclusion period in the new plan, start at the enrollment date and count backwards until you reach a significant break in coverage. So, the five months of coverage between August 1, 2005 and December 31, 2005 clearly counts against the exclusion period. But the period without insurance between February 1, 2005 and August 1, 2005 is greater than 63 days. Thus, this is a significant break in coverage, and any coverage prior to it cannot be deducted from the exclusion period. So, this person could deduct five months from his or her exclusion period, reducing the exclusion period to seven months, Hence, Title I requires that any preexisting condition begin to be covered on August 1, 2006.

Title I also forbids individual health plans from denying coverage or imposing preexisting condition exclusions on individuals who have at least 18 months of creditable group coverage without significant breaks and who are not eligible to be covered under any group, state, or federal health plans at the time they seek individual insurance [6].

Title II: Preventing Health Care Fraud and Abuse; Administrative Simplification; Medical Liability Reform
Title II of HIPAA defines numerous offenses relating to health care and sets civil and criminal penalties for them. It also creates several programs to control fraud and abuse within the health care system[7][8][9]. However, the most significant provisions of Title II are its Administrative Simplification rules. Title II requires the Department of Health and Human Services (HHS) to draft rules aimed at increasing the efficiency of the health care system by creating standards for the use and dissemination of health care information.

Click on the links to get a detailed overview of each regulation.

The Federal Information Security Management Act of 2002 ("FISMA", 44 U.S.C. § 3541, et seq.) is a United States federal law enacted in 2002 as Title III of the E-Government Act of 2002 (Pub.L. 107-347, 116 Stat. 2899). The Act was meant to bolster computer and network security within the Federal Government and affiliated parties (such as government contractors) by mandating yearly audits.

FISMA has brought attention to cybersecurity within the Federal Government, which had previously been much neglected. As of February 2005, many government agencies received extremely poor marks on the official report card, with an average of 67.3% for 2004, an improvement of only 2.3 percentage points over 2003.This shows a marginal increase in how federal agencies prioritize cybersecurity, but experts warn that this average must increase for the Government to truly protect itself.

FISMA Compliance Process for an Information System
FISMA imposes a mandatory set of processes that must be followed for all information systems used or operated by a US Government federal agency or by a contractor or other organization on behalf of a US Government agency. These processes must follow a combination of Federal Information Processing standards (FIPS) documents, the special publications SP-800 series issued by NIST, and other legislation pertinent to federal information systems, such as the Privacy Act of 1974 and the Health Insurance Portability and Accountability Act.

Determination of Boundaries of System
The first step is determining what constitutes an "information system." There is not a direct mapping of computers to information system; rather an information system can be a collection of individual computers put to a common purpose and managed by the same system owner. NIST SP 800-18 provides guidance on determining system boundaries.

Determination and Categorization of Information Types in System
The next step is to determine the information types resident in the system and categorize each according to the magnitude of harm resulting were the system to suffer a compromise of Confidentiality, Integrity, or Availability. NIST SP 800-60 provides a catalog of information types, and FIPS-199 provides a rating methodology and a definition of the three criteria. The overall FIPS-199 system categorization is the high water mark of the impact rating of all the criteria of all information types resident in the system.

Select and Implement a Set of Security Controls for System
If the system in question is in the design or implementation life-cycle phase, a set of security controls must be selected and incorporated into the system implementation. NIST SP 800-53 provides a catalog of

Documenting System
Pertinent system information such as system boundaries, information types, constituent components, responsible individuals, description of user communities, interconnections with other systems and implementation details for each security control need to be documented in the system security plan. NIST SP 800-18 Rev 1 gives guidance on documentation standards. Additional documentation such as a contingency plan for the system also needs to be prepared at this stage. Guidance on contingency planning can be found in NIST SP 800-34.

Free Membership 

Use the members forum to communicate with peers and create your own online professional network. Within your network you can share ideas and resources that you find online, discuss best practices or simply make new acquaintances.  

• Connects you to GRC Professionals; peers and IT experts.
• Social Networking facility to share best practices, in the community forum or on a one to one basis.
• Facility to create private blogs (visible to all members).
• Provides expert market intelligence to help you make informed market decisions.
• FOC access to our categorized archive of articles, whitepapers, case-studies, podcasts and webcasts.

First you should create an account to experience all of the features of the IT GRC Forum. You will be asked to provide your email address, choose a username and password, and provide some basic job and company information (optional). You do not have to list personal information on your member's profile although this may help you to network with other members.

Next you will receive an email from us asking you to confirm your registration to ITGRCForum.com, click the link and you're set! Our Production Department adds new pieces of original editorial content weekly and you will be notified to new content through e-newsletter communications. All site content is indexed continually and made available to registered users.

The United States Occupational Safety and Health Administration (OSHA) is an agency of the United States Department of Labor. It was created by Congress under the Occupational Safety and Health Act, signed by President Richard M. Nixon, on December 29, 1970. Its mission is to prevent work-related injuries, illnesses, and deaths by issuing and enforcing rules (called standards) for workplace safety and health.

OSHA Authority
OSHA's statutory authority extends to most nongovernmental workplaces where there are employees. State and local government workers are excluded from Federal coverage, however, states operating their own state workplace safety and health programs under plans approved by the U.S. Department of Labor cover most private sector workers and are also required to extend their coverage to public sector (state and local government) workers in the state. Section 2 (11) of the OSH Act encourages states to develop and operate their own state OSH programs.

The same act (OSHA) also created the National Institute for Occupational Safety and Health (NIOSH) as a research agency whose purpose is to determine the major types of hazards in the workplace and ways of controlling them. As of March 2006, the agency is headed by Assistant Secretary of Labor Edwin Foulke.

OSHA regulations [29 CFR Part 1956] also permit states without approved plans to develop plans that cover only public sector workers. In these states, private sector employment remains under Federal OSHA jurisdiction. Twenty-two states and territories operate plans covering both the public and private sectors and four states - Connecticut, New Jersey, New York and the US Virgin Islands - operate public employee only plans.

History
OSHA was widely criticized in its early years for confusing, burdensome regulations. A good deal of the early conflict came about because of arbitrary and inconsistent enforcement during OSHA's early years. In addition, businesses were expected to retrofit guards and other safety devices on existing equipment and to implement other hazard controls, often at considerable expense, to bring them in line with then-current best safety practices. Other requirements, such as mandated training, communication, and extensive documentation were seen as even more difficult and expensive.

With time, manufacturers of industrial equipment have included OSHA-compliant safety features on new machinery. Enforcement has become more consistent across jurisdictions, and some of the more outdated or irrelevant rules have been repealed or are not enforced.

During the Jimmy Carter administration, under the leadership of University of Cincinnati toxicologist Eula Bingham, OSHA began to concentrate more on health hazards, such as toxic chemicals. Bingham also launched the "New Directions" program, OSHA's first worker training grant program.

With the Ronald Reagan and George H.W. Bush administrations came efforts to weaken OSHA enforcement and rulemaking, although several important rules were issued including hazard communication (right to know about chemical exposures) and blood-borne pathogens (to protect workers against illnesses such as hepatitis and AIDS). The Reagan administration also launched OSHA's Voluntary Protection Program (VPP), OSHA's first foray into voluntary programs and partnerships with industry. In the VPP, management, labor, and OSHA establish cooperative relationships at workplaces that have implemented a comprehensive safety and health management system. Approval into VPP is OSHA's official recognition of the outstanding efforts of employers and employees who have achieved exemplary occupational safety and health.

The Bill Clinton administration began a reorganization of OSHA's approach, focusing more on "stakeholder" satisfaction through compliance assistance. When the Republicans took over Congress in 1994, one of their goals was reducing some of the agency's ability to issue standards. Some Republican sponsored bills were stopped by the Democratic minority and moderate Republicans, but other legislation passed, such as the Small Business Regulatory Enforcement Fairness Act of 1996 and the Congressional Review Act.

In 2000, OSHA issued the ergonomics standard after ten years of study and struggles with a Republican-controlled Congress and business associations such as the Chamber of Commerce and National Association of Manufacturers that were unconvinced that additional government regulation was the right way to address the issue of ergonomic injuries to American workers. Ergonomic injuries (also known as musculoskeletal injuries) such as back injuries and carpal tunnel syndrome, account for 1/3 of all serious injuries suffered by American workers. In March 2001, the Republican controlled Congress voted to repeal the standard and the repeal was one of the first major pieces of legislation signed by President George W. Bush. Since the repeal of the ergonomics standard, OSHA has issued three ergonomics guidelines, and only a small handful of ergonomic citations under the Act's "general duty" clause.