IT IS VERY IMPORTANT TO READ THE INSTRUCTIONS!!! THIS IS DOCTORAL WORK. Turnitin and Waypoint are being used to check for plagiarism, and please use APA format. Please pay close attention I NEED...

Compliance Standards and Business Reasons for Implementation
Overview of Standards
Compliance standards are important for organizations to manage sensitive data as this provide structured framework for protecting information, mitigating risks and ensuring regulations. The relevant compliance standards include:
· HIPAA:
HIPAA applies to healthcare institutions like ABC Medical Centre and this is designed to ensure safety of Protected Health Information. The standard provides strict controls over the confidentiality, integrity and availability of patient data.
· Key Requirements:
· Data Encryption: All PHI must be encrypted during transmission and storage to prevent unauthorized access.
· Access Controls: Implement role-based access to ensure that only authorized personnel can access sensitive data.
· Auditing: Maintain logs of data access and modifications to track accountability and identify potential
eaches.
· Incident Response: Development of the response plan for data
eaches including notification procedures for affected parties and regulatory bodies.
· PCI DSS
This standard is applicable to institutions like ABC Bank that will process, store and transmit credit card data (Barabas & Dragičević, 2021). PCI DSS ensures secure handling of cardholder information to prevent fraud and data
eaches.
· Key Requirements:
· Data Encryption: Encrypt credit card data during transmission over public networks.
· Access Controls: Restrict access to cardholder data on need-to-know basis.
· Monitoring and Testing: Regularly monitor network activity and conduct vulnerability assessments.
· Incident Management: Establishment of plan to respond to security incidents including communication that will affect customers and payment networks.
· FISMA:
FISMA can help organizations like ABC Storage Solutions for bidding for government contracts. It requires risk management to protect sensitive federal information.
· Key Requirements:
· Risk Assessment: Identify risks to information systems and implement measures to address the risk.
· System Security Plans: This requires documenting security controls and policies.
· Continuous Monitoring: Regularly evaluate systems for compliance and emerging threats.
· Incident Reporting: Notify federal agencies promptly about security incidents that can affect government data.
Business Reasons for Compliance
1. Avoiding Penalties and Legal Consequences:
Non-compliance can result in fines and sanctions. In the case, HIPAA violations this can result in penalties ranging from $100 to $50,000 per violation with the annual penalty of $1.5 million. PCI DSS non-compliance may lead to fines that are imposed by payment processors and this can cause loss of ability to process card transactions. For FISMA, failure can result in losing federal contracts and issues with revenue streams of organization.
2. Protecting Organizational Reputation:
The data
each can damage to reputation to organization that can harm trust of customers, partners and regulators. In case of healthcare providers like ABC Medical centre, the
each of PHI can undermine patient confidence. For financial institutions, the failure to protect cardholder data can lead to loss of customer loyalty and negative publicity (Chinthala & Sekar, 2021). Compliance describes the commitment to security and privacy for ensuring trust and credibility.
3. Maintaining Trust with Stakeholders:
Customers and partners are prioritizing data security. Compliance assures stakeholders that organization ensures safety of sensitive information. Compliant bank reassures that customer that financial data is secure. The compliant healthcare provider assures patients that medical records are handled properly.
4. Financial Impact of Non-Compliance:
· Legal Actions: Class-action lawsuits from affected customers can result in costly settlements.
· Loss of Partnerships: Payment processors and government agencies may terminate partnerships with non-compliant organizations for reducing revenue streams.
· Remediation Costs: Recovering from data
each requires significant investment in security upgrades, staff training and public relations campaigns.
5. Strategic Benefits of Compliance:
· Operational Efficiency: This requires implementation of structured processes for reducing inefficiencies and ensuring consistent performance. The access controls and encryption protocols can ensure better management of sensitive data.
· Customer Confidence: The compliant organization attracts and retains customers by demonstrating commitment to protect the data. For healthcare providers, this can result in higher patient retention rates. For banks, it may lead to increased use of financial services.
· Competitive Advantage: Organizations should focus on competitive edge by aligning with best practices and industry standards. This can help secure contracts, attract business partners and differentiate in the market.
Network Design and Segmentation
Type of Network Design
1. Core Design Principles:
· Layered Security: The defence-in-depth with multiple layers of protection can help to mitigate threats on the network.
· Segmentation: Division of network in zones, isolating public-facing systems, internal systems and sensitive data storage to can prevent unauthorized access.
· High Availability: Implementation of redundant connections, load balancers and failover systems will ensure continuous operations even during outages (Fennelly & Pe
y, 2022).
· Secure Communication: Use encrypted communication channels for all data transfers to comply with standards like HIPAA, PCI DSS and FISMA.
2. Key Components:
· Demilitarized Zone (DMZ): The use of public-facing applications like web servers and customer portals while isolating from internal systems.
· Private Zone: Houses sensitive data storage like Protected Health Information for HIPAA and cardholder data for PCI DSS.
· Internal Zone: This includes employee workstations, internal applications and administrative systems for ensuring separation from critical data repositories.
· Redundant Gateways: This ensures uninte
upted connectivity to external networks for reducing risk of downtime.
· Network Access Control: This includes authentication and authorization policies to restrict access based on user roles and device compliance.
Network Diagram
Figure 1: Network Diagram
Segmentation Strategy
1. Demilitarized Zone (DMZ):
· Purpose: Provides buffer between public internet and internal systems.
· Components: Web servers, customer-facing applications and APIs.
· Security Measures:
· Deployment of perimeter firewalls to restrict inbound and outbound traffic.
· Monitor activity in DMZ using intrusion detection systems.
· Use reverse proxies to safeguard backend services from direct exposure.
2. Private Zone:
· Purpose: Protects sensitive data like PHI, cardholder data and federal records.
· Components: Database servers, encryption appliances and secure storage solutions.
· Security Measures:
· Restrict access to authorized personnel using multi-factor authentication.
· Encrypt data at rest and in transit using industry-standard protocols like AES-256.
· Segment the zone with dedicated firewalls and implement strict access control lists.
3. Internal Zone:
· Purpose: Supports operational systems like employee workstations, HR systems and internal applications.
· Components: Workstations, file servers and internal messaging platforms.
· Security Measures:
· Deployment of endpoint detection and response tools to identify potential threats.
· Include policies based on principle of least privilege that allows employees to access only that is required in the...