Information Security Laws, Regulations and Compliance
Compliance asks whether you can map obligations in law, regulation and contract onto controls, and prove it. CISM tests the distinction between being compliant and being secure, and expects awareness of the major regimes rather than legal drafting skill.
Core rules
- Sources of obligation. Statutory law, sector regulation, contractual terms (PCI DSS, customer security schedules), and standards adopted voluntarily (ISO/IEC 27001) which become binding once contracted.
- Compliance is a floor, not a ceiling. A control set built only to pass an audit can leave material risk untreated. Conversely, a well-secured organisation can still fail an audit through missing evidence - compliance requires documented, retrievable proof.
- Major regimes to recognise. GDPR (EU/EEA personal data, extraterritorial reach, 72-hour breach notification to the supervisory authority where required). PCI DSS (payment card data, contractual, prescriptive technical requirements). SOX (financial reporting controls, executive certification). China's Cybersecurity Law, Data Security Law and Personal Information Protection Law, plus the Multi-Level Protection Scheme (MLPS 2.0) grading and filing obligations. China's PIPL applies extraterritorially to processing the personal information of individuals in China for providing products or services or analysing behaviour, and cross-border transfer must use one of the prescribed mechanisms (security assessment, standard contract filing, or certification).
- Data classification is the hinge. Personal information, sensitive personal information, and important data carry different obligations for consent, impact assessment, retention and cross-border transfer. Classify first, then map controls.
- Privacy principles map directly to controls: lawfulness and consent, purpose limitation, minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.
- Retention and e-discovery. Retain records per legal and contractual schedules, then dispose of them verifiably; litigation holds override routine deletion.
Worked example
A European retailer sells to customers in mainland China through a local app and stores data on EU servers. PIPL is engaged even though the company is not established in China, because it processes personal information of individuals in China to provide goods. The compliance answer: appoint a local representative where required, establish a lawful basis and separate consent for sensitive personal information, complete a personal information protection impact assessment, and select a cross-border transfer mechanism before the data leaves - not after a breach reveals that transfers were happening.
Traps that cost marks
- Claiming a third-party certification proves legal compliance.
- Assuming GDPR applies only to EU-established companies.
- Answering "ask legal" where the question wants the compliance control or the mapping step.
- Forgetting that cross-border transfer and data localisation rules are triggered by where data goes, not where the company is registered.