Sarbanes-Oxley Act (SOX): Federal law that mandates specific security controls and audit requirements for publicly traded companies, focusing on financial reporting and internal controls

Federal Information Security Management Act (FISMA): Legislative framework that provides security standards and guidelines for federal information systems and their contractors

Health Insurance Portability and Accountability Act (HIPAA): Federal law requiring healthcare organizations to implement security measures to protect patient health information, including specific audit requirements

Gramm-Leach-Bliley Act (GLBA): Federal law requiring financial institutions to implement comprehensive security programs and protect customer data

Payment Card Industry Data Security Standard (PCI DSS): Security standard for organizations that handle credit card data, requiring regular security audits and specific security controls

California Consumer Privacy Act (CCPA): State law providing California residents with data privacy rights and imposing security obligations on businesses handling their data

Virginia Consumer Data Protection Act (VCDPA): State law establishing data privacy and security requirements for businesses operating in Virginia

NIST Cybersecurity Framework: Voluntary framework providing guidelines for private sector organizations to assess and improve their ability to prevent, detect, and respond to cyber attacks

ISO 27001: International standard providing requirements for information security management systems (ISMS) and security controls

CIS Controls: Set of cybersecurity best practices and controls developed by the Center for Internet Security

COBIT Framework: Framework for the governance and management of enterprise IT, including security audit requirements

FedRAMP: Federal program providing standardized security assessment and authorization for cloud services used by government agencies

GDPR: European Union regulation with extraterritorial scope affecting US organizations that handle EU resident data

State Data Breach Notification Laws: Various state-specific requirements for reporting and responding to data breaches, affecting security audit policies

State Cybersecurity Regulations: State-specific cybersecurity requirements and guidelines that may affect security audit procedures and policies