Compliance, Audit, and Awareness
What to know
Compliance questions test whether you can distinguish obligation, control, and evidence. Know the major regimes by purpose: GDPR for personal data and privacy rights, HIPAA for health information, PCI DSS for card data, SOX for financial reporting controls, and sector regulators. Understand that compliance is a floor, not a ceiling, and that being compliant does not mean being secure. Know the audit lifecycle: scoping, evidence collection, testing, findings, remediation, and management response.
Understand control frameworks and mapping: how a single control can satisfy multiple requirements, and why control mapping reduces duplicate effort. Know the difference between an internal audit, an external audit, and a certification audit, and the role of the three lines of defense. Know evidence quality: contemporaneous, attributable, complete, and retained.
Awareness and training concepts: role-based training, phishing simulation ethics and metrics, reporting culture, and measuring behavior change rather than completion rates. Know policy attestation and acceptable use.
Traps
- Treating a passed audit as proof of security.
- Confusing a policy gap with a control failure.
- Reporting training completion as evidence of reduced risk.
- Missing evidence retention and attribution requirements.
Worked example / rule of thumb
An auditor asks for access review evidence. Correct: show the review performed on schedule, by the right reviewer, with decisions recorded and removals verified, retained per policy. Rule of thumb: if it is not documented and attributable, it did not happen.