Question $2$

Susan works for a U$.$S$.$ investment firm that is required to be registered with the Securities and Exchange Commission. Susan is

responsible for implementing access controls on the organization's database servers. Which one of the following laws must her

organization comply with?

Health Insurance Portability and Accountability Act $($HIPAA$)$

Family Educational Rights and Privacy Act $($FERPA$)$

General Data Protection Regulation $($GDPR$)$

Sarbanes$-$Oxley Act $($SOX$)$