The U.S. doesn’t have a federal cybersecurity law, but that doesn’t mean there is no cybersecurity industry standard. There are regulations, case law, guidelines and state laws that, when combined, create an industry standard applicable to almost all business sectors. Specifically, if you receive, collect or hold data in an enumerated industry or sector, your business must have an information security program in place.
Many of the existing laws protect publicly traded companies and the banking, health care, financial and insurance sectors. Third-party vendors, including law firms, are specifically enumerated in many state statutes. Nevada even has a relatively new statute that protects casinos. The combination of these new state statutes and federal guidelines provide a basket weave of compliance.