Title: Explain laws and regulations applicable to cybersecurity in manufacturing systems.
Course: Cybersecurity in Manufacturing, Advanced (13002-IV) > Section: Applying Cybersecurity Standards and Regulations to Manufacturing Systems

Explanation may include, but not be limited to,

- federal laws, regulations, policies
  - Defense Federal Acquisition Regulation Supplement (DFARS) (https://www.acq.osd.mil/dpap/dars/dfarspgi/current/index.html)
  - Executive Order (EO) 13636 Improving Critical Infrastructure Cybersecurity and Presidential Policy Directive (PPD) 21 Critical Infrastructure Security and Resilience (https://www.dhs.gov/publication/eo-13636-ppd-21-fact-sheet)
  - Privacy Act of 1974 (https://www.justice.gov/opcl/privacy-act-1974)
  - Electronic Communications Privacy Act of 1986 (ECPA) (https://it.ojp.gov/PrivacyLiberty/authorities/statutes/1285)
  - Counterfeit Access Device and Computer Fraud and Abuse Act of 1984 (https://www.congress.gov/bill/98th-congress/house-bill/5112)
  - Cyber Security Information Sharing Act of 2015 (CISA) (https://www.dni.gov/index.php/ic-legal-reference-book/cybersecurity-act-of-2015)
  - Health Insurance Portability and Accountability Act (HIPAA) (https://www.hhs.gov/hipaa/index.html)
  - Telecommunications Act of 1996 (https://www.fcc.gov/general/telecommunications-act-1996)
  - Chemical Facility Anti-Terrorism Standards (CFATS) (https://www.dhs.gov/cisa/chemical-facility-anti-terrorism-standards)
- international laws and standards
  - General Data Protection Regulation (GDPR) (https://www.ncsc.gov.uk/GDPR)
  - European Union (EU) directive on security of network and information systems (NIS Directive) (https://ec.europa.eu/digital-single-market/en/network-and-information-security-nis-directive)
  - North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) (https://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx).

Process/Skill Questions:

- Why is EO 13636 important to the manufacturing industry?
- What effect has HIPAA had on the product security in the manufacturing of medical devices?
- How do older regulations affect the current state of cybersecurity?