CEICC study guide
CEICC · Work through your exam, one topic at a time.
The Certified Expert in International Compliance and Cybersecurity (CEICC) is a vendor-neutral credential for professionals who sit where regulatory obligation meets technical security - compliance officers moving into cyber, security managers who own regulatory mapping, and consultants serving multinational clients. The exam tests breadth across seven domains: compliance frameworks and the regulatory landscape, international data protection and privacy law, cybersecurity governance and risk management, security controls and technical safeguards, incident response and breach notification, third-party and supply chain risk, and audit, assurance, and compliance monitoring. The CEICC study guide has 7 sections and about 2,105 words.
01Compliance Frameworks and Regulatory Landscape
A compliance framework is a structured set of controls, objectives, and evidence requirements that an organization maps its practices against. Candidates must distinguish laws and regulations (mandatory, jurisdiction-bound, enforceable by regulators) from standards and frameworks (voluntary or contractual baselines such as ISO/IEC 27001, NIST CSF, SOC 2 trust services criteria, or PCI DSS, which becomes mandatory through contracts or card-brand rules).
336 words, about 2 min02International Data Protection and Privacy Law
Privacy law questions hinge on roles, lawful bases, and cross-border mechanics . Learn the GDPR vocabulary: controller (determines purposes and means) vs.
327 words, about 2 min03Cybersecurity Governance and Risk Management
Governance is about direction, accountability, and oversight : board and executive responsibility, a documented risk appetite, security strategy aligned to business objectives, and reporting lines that give leadership meaningful risk information. Candidates must know the risk management lifecycle - identify, assess, treat (accept, mitigate, transfer, avoid), monitor - and the difference between inherent risk (before controls) and residual risk (after controls).
297 words, about 1 min04Security Controls and Technical Safeguards
Controls are categorized as administrative, technical, and physical , and by function as preventive, detective, corrective, and compensating . Candidates should understand defense in depth, least privilege, separation of duties, encryption in transit and at rest, key management, logging and monitoring, vulnerability and patch management, and identity controls including MFA and privileged access management.
277 words, about 1 min05Incident Response and Breach Notification
Incident response follows a lifecycle: prepare, detect and analyze, contain, eradicate, recover, and learn . Candidates must distinguish an event (observable occurrence) from an incident (confirmed adverse event requiring response) and a breach (incident involving unauthorized access to or disclosure of protected data).
294 words, about 1 min06Third-Party and Supply Chain Risk
Third-party risk management spans the full lifecycle: due diligence before onboarding, contractual controls, ongoing monitoring, and offboarding . Candidates should understand tiering vendors by criticality and data access, the role of security questionnaires and independent reports (SOC 2, ISO certificates), right-to-audit clauses, subprocessor approval, data processing agreements, and concentration risk (over-reliance on a single provider).
284 words, about 1 min07Audit, Assurance, and Compliance Monitoring
Assurance is about independent, evidence-based confidence . Candidates must understand the audit process: scoping, planning, fieldwork (evidence gathering, sampling, testing), reporting, and follow-up.
290 words, about 1 min