ABSTRACT
An organization’s information security program needs structure in order be successfully to protect its sensitive/confidential data from falling into the hands of its adversaries. There are many methods available to an adversary for breaching an Information System security protection barrier in any organization today. One of the main goals of adversaries is to obtain data illegally from an organization or user. A data breach may occur when there is a loss, theft, or other unauthorized access to data containing sensitive material that results in the potential compromise of the confidentiality, integrity, or availability. “An information security program begins with policy, standards, and practices, which are the foundation for the information security architecture and blueprint. In order for an organization’s information security program to succeed. It will need to “operate in conjunction with the organization’s established security policy.” (Whitman & Mattord, 2012) This case study will discuss the legal environment for an organization, which includes policies, regulations, and laws. Also, it will illustrate how these factors impact an organization to ensure the confidentiality, integrity, and availability of information and information systems.

Foremost, in any organization, confidentiality, integrity, and availability (CIA triad) is the model which is supposed to guide information security policies that are established. Policies play an important role in any organization. They “direct how issues should be addressed and technologies should be used.” (Whitman & Mattord, 2012) As Information security practitioners, we use government and organizational policies as our stepping stones or foundational material to establish a rock solid information security program. In information security, government policies are issued by federal, state, local,