CEICC cheat sheet

Binding law vs. framework: statutes and regulations create enforceable obligations; frameworks (ISO 27001, NIST CSF, SOC 2) are voluntary unless contractually or regulatorily adopted.

Regulatory hierarchy: law > regulation (agency rulemaking) > guidance/standard > framework; lower tiers interpret but do not override higher tiers.

ISO/IEC 27001 is a certifiable management-system standard (ISMS); ISO/IEC 27002 supplies control guidance and is not certifiable on its own.

NIST CSF core functions: Identify, Protect, Detect, Respond, Recover (Govern added in CSF 2.0).

SOC 2 reports are attestations against Trust Services Criteria (security plus optional availability, processing integrity, confidentiality, privacy); Type I = design at a point in time, Type II = operating effectiveness over a period.

Scope decisions determine applicability: entity size, sector, data types processed, and cross-border reach (e.g., extraterritorial clauses) drive which regimes bind.

Regulatory change management: track obligations via a compliance register mapped to controls, with owners and review cadence.

Safe-harbor and adequacy mechanisms (e.g., approved codes, contractual clauses) can satisfy a requirement without changing the underlying control.

GDPR lawful bases: consent, contract, legal obligation, vital interests, public task, legitimate interests - only one is needed, but it must be documented.

Data subject rights under GDPR include access, rectification, erasure, restriction, portability, and objection; response deadline is generally one month, extendable by two.

GDPR breach notification: notify the supervisory authority within 72 hours of awareness unless unlikely to result in risk; notify individuals when high risk.

Controller determines purposes and means; processor acts on documented instructions; joint controllers share responsibility for common processing.

Cross-border transfer tools: adequacy decision, standard contractual clauses, binding corporate rules, and derogations; each requires a transfer impact assessment in many regimes.

Privacy principles (OECD/GDPR): lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, accountability.

Data Protection Impact Assessment is required for high-risk processing such as large-scale special-category data or systematic monitoring.

Special categories (health, biometrics, ethnicity, etc.) require a separate condition for processing beyond a standard lawful basis.

Risk = likelihood × impact; qualitative scales (e.g., 1-5) are common, and residual risk = inherent risk minus control effectiveness.

Risk treatment options: mitigate, transfer, avoid, accept; acceptance must be documented with an accountable owner and expiry.

Three lines model: operations own risk (first), risk/compliance functions oversee (second), internal audit provides independent assurance (third).

Board accountability: governance requires defined risk appetite, tolerance thresholds, and reporting of key risk indicators to senior leadership.

NIST RMF steps: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor.

ISO/IEC 27005 and NIST SP 800-30 describe risk assessment methodology: asset identification, threat and vulnerability pairing, likelihood, impact, and treatment.

Key risk indicators should be measurable, tied to thresholds, and reviewed on a defined cadence to signal drift from appetite.

Business continuity and disaster recovery objectives are expressed as RTO (recovery time) and RPO (recovery point).

Control categories: preventive, detective, corrective, deterrent, compensating; control types: administrative, technical, physical.

Defense in depth layers controls so a single failure does not cause compromise; least privilege and separation of duties limit blast radius.

Encryption: at rest protects stored data; in transit protects data on the wire (TLS); key management (rotation, custody, HSM) determines real protection.

AAA = authentication (verify identity), authorization (grant permissions), accounting (log activity).

MFA factors: something you know, have, or are; combining two from different categories satisfies MFA.

Vulnerability management lifecycle: discover, prioritize (CVSS plus exploitability/asset criticality), remediate, verify, report.

Logging and monitoring require integrity protection, time synchronization, retention per policy, and alerting on defined thresholds.

Change management requires approval, testing, and rollback plans; segregation of duties prevents one person from authoring and deploying changes.

Incident response lifecycle: preparation, detection and analysis, containment/eradication/recovery, post-incident activity.

Breach notification clocks vary by regime: GDPR 72 hours to regulator; many U.S. state laws require notice without unreasonable delay, often with specific day limits.

Notification triggers usually depend on risk of harm to individuals; document the risk assessment that supports notify or no-notify decisions.

Preserve evidence with chain of custody; forensic images and logs support both investigation and later regulatory or legal review.

Containment choices: short-term (isolate systems) versus long-term (rebuild, patch) - record decisions and rationale in the incident log.

Post-incident reviews produce lessons learned mapped to control improvements, closing the loop with risk management.

Regulator and law-enforcement engagement has legal privilege and timing implications; involve counsel early for material incidents.

Tabletop exercises and defined severity tiers test escalation paths and communication roles before a real event.

Vendor lifecycle: due diligence, contracting with security terms, onboarding, ongoing monitoring, offboarding and data return/destruction.

Tiering vendors by data sensitivity and criticality drives the depth of assessment and review frequency.

Contract clauses to require: security obligations, breach notification timelines, audit/right-to-assess, subprocessor approval, data return and deletion, liability.

Concentration risk arises when many critical functions depend on one provider; map dependencies and identify single points of failure.

Fourth-party risk: assess subprocessors and downstream providers, not just direct vendors.

Continuous monitoring signals include certifications (SOC 2 Type II, ISO 27001), security ratings, and questionnaire refresh cadence.

Supply chain integrity controls cover software provenance, component inventory (SBOM), and vendor patch responsiveness.

Exit planning: define data portability, transition assistance, and destruction verification before contract termination.

Assurance types: first-party (self-assessment), second-party (customer/partner audit), third-party (independent audit or certification).

Audit phases: planning/scoping, fieldwork and evidence collection, reporting, and management remediation tracking.

Evidence must be sufficient, reliable, and relevant; sampling risk means population definition and sample size affect conclusions.

Findings are rated by severity (e.g., critical/high/medium/low) and tracked to closure with owners and due dates.

Compliance monitoring uses continuous control monitoring, KRIs, and periodic testing to detect control drift between audits.

Audit independence requires the auditor not design or operate the controls being tested.

Control mapping lets one control satisfy multiple framework requirements, reducing duplicated testing effort.

Remediation is verified by retesting; unverified closures create false assurance.

Frameworks become mandatory through adoption: contract terms, regulator expectations, or certification scope convert voluntary guidance into obligations.

Certification scope statements define which systems, locations, and processes are covered; exclusions must be justified and documented.

A Statement of Applicability records which ISO 27001 controls apply, why, and implementation status.

Regulatory exams and supervisory reviews often request evidence of governance, risk assessment, and control testing, not just policy documents.

When regimes conflict, document the conflict, apply the stricter requirement where lawful, and escalate to legal counsel.

Accountability requires demonstrating compliance (records of processing, policies, DPIAs), not merely complying.

Privacy by design and by default embeds protections into systems and settings rather than adding them later.

Processor obligations include maintaining records, assisting with data subject requests, and notifying the controller of breaches without undue delay.

Cross-border transfer mechanisms are regime-specific; a mechanism valid in one jurisdiction may not satisfy another.

Retention schedules should be tied to purpose and legal requirements, with defensible deletion evidence.

Risk register entries include asset/process, threat, vulnerability, likelihood, impact, inherent and residual rating, owner, and treatment.

Risk appetite is set by the board; tolerance is the acceptable variance from appetite at the operational level.

Scenario and stress testing reveal risks that point-in-time assessments miss.

Third-party and cyber insurance are transfer treatments; they do not eliminate residual risk.

Metrics should be leading (control coverage, patch latency) and lagging (incidents, losses).

Access control models: RBAC (role-based), ABAC (attribute-based), MAC (mandatory); choose based on granularity and administrative cost.

Zero trust assumes no implicit trust based on network location; verify explicitly and enforce least privilege.

Patch management metrics: mean time to remediate by severity; critical vulnerabilities typically require shorter SLAs.

Configuration baselines (CIS Benchmarks, hardening guides) reduce drift and are testable controls.

Data loss prevention, encryption, and tokenization are data-centric controls; network segmentation is an architecture control.

Incident severity classification drives escalation, notification, and resource allocation; define criteria in advance.

The incident commander coordinates response; communications, legal, and technical leads have defined roles.

Regulatory notification content typically includes nature of breach, categories and numbers affected, likely consequences, and measures taken.

Some regimes require notifying affected individuals even when law enforcement is engaged; legal review resolves sequencing.

Documentation should establish the timeline of awareness, containment, and notification to demonstrate reasonableness.

Due diligence depth should be proportionate to criticality: questionnaires, certifications, and on-site or remote assessments.

Right-to-audit clauses should specify scope, notice, frequency, and use of third-party auditors.

Vendor breach notification timelines should be shorter than the organization's own regulatory deadline to allow assessment.

Subprocessor changes should require notice and approval rights to preserve control over data flows.

Ongoing monitoring includes periodic reassessment and tracking of vendor security incidents and rating changes.

Audit scope defines systems, period, and criteria; changes in scope mid-audit require documented approval.

Evidence quality hierarchy: system-generated logs and independent observation are stronger than self-reported attestations.

Findings should distinguish root cause from symptom to prevent recurrence.

Continuous control monitoring automates evidence collection and flags exceptions for human review.

Management responses should include corrective action, owner, and target date; auditors verify closure.