Why this matters
A source-led guide to governance and security frameworks, with clear boundaries between binding rules and voluntary guidance. Evaluate the particular asset, access pathway, affected parties, and evidence before assigning a risk classification. These are analytical controls to consider, not a claim that every organization faces the same exposure.
Jurisdiction and scope
Read the authoritative text for the covered actor, covered data, regulated action, exceptions, and effective dates. A label such as genetic data does not by itself determine legal coverage.
NIST guidance
Threat modeling supports structured analysis of a workflow. The cited project includes draft material; its examples are not a register of attacks or a certification.
U.S. DOJ Data Security Program
The official program addresses certain transactions involving covered access to bulk sensitive data. The program took effect April 8, 2025; use the official materials to evaluate a specific transaction.
Other policy questions
HIPAA, GINA, state laws, and international rules have different scopes. This first edition does not provide a jurisdiction-by-jurisdiction legal digest.
Read the obligation before choosing a control
Policy analysis begins with the actual rule and the situation it covers. Identify the authority, jurisdiction, regulated activity, relevant data, and effective date. Then check definitions and exceptions in context. A summary can orient a reader, but it should not silently expand the reach of the underlying text.
For example, a rule about certain transactions cannot be reduced to a statement that a particular kind of data must never leave a country. The parties, access arrangement, and covered activity may all matter. This library uses the DOJ case to introduce that distinction; the official program materials remain the place to examine the requirements themselves.
Keep guidance and obligations separate
A threat model can help an organization identify weaknesses without creating a legal duty to implement every suggested control. A technical standard, a contract, and a statute can use similar words while operating in different ways. Record the source and its status when explaining why a measure is required or recommended.
This also prevents a familiar mistake: treating the existence of a policy as proof that an organization follows it. A published access policy describes the intended rule. Evidence of implementation might include permissions, review records, and the handling of exceptions. Those are different kinds of evidence and deserve separate claims.
Make policy notes maintainable
A useful policy note states which version was reviewed and what question it answers. If the rule changes, readers should be able to see which part of the analysis needs revisiting. Avoid an undated claim that a practice is always allowed or always prohibited. The narrower, dated explanation is usually more useful to someone making a real decision.
Core definitions
- Genetic Exposure Radius — Scope of relational exposure
- Genetic Persistence Risk — Durability after compromise
- Genetic Provenance Integrity — Verifiability of the chain of custody
- PRIMARY SOURCE NIST: Genomic Data Threat Modeling
- PRIMARY SOURCE U.S. DOJ Data Security Program