Compliance Frameworks and Regulatory Landscape
What to know
A compliance framework is a structured set of controls, objectives, and evidence requirements that an organization maps its practices against. Candidates must distinguish laws and regulations (mandatory, jurisdiction-bound, enforceable by regulators) from standards and frameworks (voluntary or contractual baselines such as ISO/IEC 27001, NIST CSF, SOC 2 trust services criteria, or PCI DSS, which becomes mandatory through contracts or card-brand rules). Understand the concept of control mapping and harmonization - one control can satisfy multiple framework requirements - and the difference between certification (independent attestation against a standard), attestation (an auditor's opinion on management's description, e.g., SOC 2 Type II), and self-assessment.
Traps
Questions love to blur the lines: a framework is not a law; a certification does not equal legal compliance; passing an audit does not guarantee security. Watch for scope traps - a SOC 2 report covers only the systems in its scope, and an ISO certificate covers only the declared ISMS scope. Also beware of prescriptive vs. principles-based framing: PCI DSS is highly prescriptive, while NIST CSF is outcome-oriented.
Worked example / rule of thumb
A fintech must satisfy GDPR (law), PCI DSS (contractual card-brand standard), and a bank partner's security addendum (contract). The candidate's job is to build a control matrix mapping each requirement to a single implemented control and its evidence. Rule of thumb: law → obligation; standard → method; contract → enforceable promise. Always ask "who can compel this, and under what authority?"
Exam focus
Know the purpose of each major framework family, the meaning of scoping, and how obligations stack when multiple regimes apply to the same system or data.