Security Policies, Laws, and Compliance
This domain tests how policies are structured, what they oblige you to do, and where legal duties such as privacy and breach notification appear. Items often contrast a policy with a standard, procedure or guideline, or ask which obligation applies to a given request.
The document hierarchy
- Policy: management intent and mandatory direction, deliberately broad.
- Standard: specific, measurable mandatory requirements, such as password length.
- Procedure: step-by-step instructions for carrying out a task.
- Guideline: recommended practice, advisory rather than compulsory.
Common policies include acceptable use, access control, data classification, incident management, BYOD, email and internet use, and remote access. Accepting a policy at onboarding or annually creates a documented obligation.
Legal and contractual awareness
Privacy law such as the GDPR, China PIPL or California CCPA/CPRA creates duties around lawful processing, individual rights and breach notification. Under the GDPR, controllers must notify the supervisory authority within 72 hours of becoming aware where the breach is likely to risk rights, and inform individuals when risk is high. Computer misuse law covers unauthorized access. Copyright and software licensing restrict copying and unlicensed installs. NDAs and confidentiality clauses cover information shared with third parties. Records retention schedules and legal hold govern how long data is kept.
Compliance behavior
Ask before exceptions rather than assuming silence means permission. Keep audit trails and evidence. Report violations, including your own. Apply the stricter rule when policy and contract conflict, and escalate to legal or compliance rather than deciding alone.
Worked example
An employee wants to install a free online tool that will process customer names and addresses. Steps: check the acceptable use policy and software approval process; assess whether personal data leaves the organization and where the vendor stores it; check the license terms; request an exception with a documented risk assessment if the tool is genuinely needed. Reasoning: convenience does not override data protection, licensing or procurement obligations, and the request route protects the employee as well as the company.
Marks that are easy to lose
- Calling a guideline mandatory or a procedure strategic.
- Assuming anything not explicitly forbidden is allowed.
- Assuming privacy law is identical across countries.
- Believing anonymized data carries the same obligations as personal data, or the reverse.