CEICC study plan

Map each major compliance framework (ISO 27001, SOC 2, NIST CSF, PCI DSS, HIPAA, GDPR-aligned regimes) to its scope, control families, and certification or attestation model

Distinguish prescriptive, principle-based, and risk-based frameworks and explain when each applies to an organization

Draft a one-page comparison of framework applicability by industry and data type

Identify the regulatory bodies and enforcement mechanisms associated with each framework you listed

Trace how regulatory obligations from Domain 1 translate into concrete privacy requirements under international data protection law

Define core privacy principles (lawfulness, purpose limitation, data minimization, storage limitation, accuracy, integrity, accountability) and locate them in at least two jurisdictions' regimes

Classify personal data categories including special-category and sensitive data and state the heightened obligations for each

Compare cross-border transfer mechanisms (adequacy decisions, standard contractual clauses, binding corporate rules) and note their conditions

Enumerate data subject rights and describe the operational process an organization needs to fulfill each within statutory timelines

Apply privacy-by-design and data protection impact assessment concepts to a hypothetical processing activity

Explain the roles and obligations of controller, processor, and joint controller in a multi-party data flow

Analyze a sample cross-border data flow and select an appropriate transfer mechanism with justification

Build a risk register from a scenario by identifying assets, threats, vulnerabilities, and likelihood-impact ratings

Distinguish risk appetite, tolerance, and capacity and apply them to prioritizing treatments

Compare risk treatment options (mitigate, transfer, avoid, accept) and select defensible choices for each register entry

Map governance structures including board oversight, a security steering committee, and defined roles such as CISO and risk owner

Translate governance decisions from Domain 3 into a layered control architecture spanning administrative, technical, and physical safeguards

Select controls that satisfy a stated requirement across identity and access management, encryption, logging, and network segmentation

Justify control selection against a named framework and explain how control effectiveness will be measured

Identify common control failure modes and the compensating controls that address them

Design an incident response lifecycle covering preparation, detection, containment, eradication, recovery, and lessons learned

Determine breach notification obligations and deadlines across the jurisdictions studied in Week 2 and the frameworks studied in Week 1

Draft a notification decision tree that accounts for data type, affected population, and regulatory trigger

Assign incident roles and escalation paths and identify evidence-preservation requirements during response

Run a tabletop walkthrough of a breach scenario and document where the playbook from Week 6 fails or needs amendment

Assess third-party risk by tiering vendors and defining due-diligence depth by tier

Evaluate contractual safeguards including security addenda, audit rights, subprocessor obligations, and breach notification clauses

Map supply chain concentration and fourth-party dependencies and identify single points of failure

Design an audit and assurance program specifying evidence types, sampling approach, and control testing cadence

Distinguish internal audit, external audit, and continuous compliance monitoring and state the purpose of each

Synthesize all seven domains into a consolidated compliance program outline

Complete a timed mixed-domain practice set and review every missed item to its underlying concept