I85PREP
⌘ K
CSG study materials
CSG study resources

CSG: Compliance and Regulatory Requirements

CSG · Work through your exam, one topic at a time.

All guide sections

Compliance and Regulatory Requirements

Compliance is the state of meeting obligations imposed by law, regulation, contract, or adopted standard. The CSG exam tests whether you can identify which obligations apply, distinguish legally binding requirements from voluntary frameworks, map controls once to satisfy many obligations, and produce credible evidence.

Know the source of the obligation

  • Legislation and regulation are mandatory and enforceable: GDPR, HIPAA, SOX, and national privacy and breach-notification laws. Contractual obligations such as PCI DSS bind through agreements with acquirers and card brands, not statute.
  • Standards and frameworks - ISO/IEC 27001, NIST CSF 2.0, COBIT - are voluntary unless adopted by contract, regulation, or internal policy. ISO/IEC 27001 certification demonstrates a management system; it does not confer legal compliance.
  • Scope matters. GDPR Article 3 applies extraterritorially to processing of EU data subjects' personal data regardless of where the organisation is established. HIPAA applies to covered entities and their business associates. SOX section 404 covers internal control over financial reporting for US public companies. PCI DSS v4.0 applies to the cardholder data environment.
  • Build a compliance obligations register: obligation, source, applicability rationale, mapped controls, evidence owner, review date.

Audit and evidence

  • First-party audit is internal; second-party is performed by a customer or supplier on you; third-party is independent certification or regulatory examination.
  • Evidence is sampled: configuration exports, logs, tickets, approvals, training records, and signed policies. Evidence must be dated, attributable, and reproducible.
  • Effective programmes map one control to multiple obligations, then monitor continuously rather than preparing only before an audit.

Worked example

A US company stores data of EU customers on servers in Virginia. The team argues GDPR does not apply because processing occurs outside the EU. That reasoning fails: Article 3(2) applies because the company offers goods or services to EU data subjects. The analysis then covers the lawful transfer mechanism, a data processing agreement with the vendor under Article 28, records of processing under Article 30, and breach notification to the supervisory authority within 72 hours where the threshold is met. State privacy law may add obligations, so the register records both with separate owners and review dates.

Traps that cost marks

  • Assuming territorial processing determines GDPR applicability.
  • Treating PCI DSS as law, or treating ISO/IEC 27001 certification as proof of legal compliance.
  • Missing contractual flow-down requirements imposed by customers.
  • Treating compliance as a one-time project rather than a monitored, changing obligation.