Cybersecurity Compliance and Regulatory Frameworks
Domain 2: Cybersecurity Compliance and Regulatory Frameworks
This domain tests how to turn legal obligations into an auditable compliance program. Expect scenario questions that give an organization's sector, data types, geography, and customer contracts, then ask which framework is mandatory, which is voluntary evidence, and what control gap remains.
Mandatory vs. voluntary
- Statutes and regulations create enforceable duties. Examples: HIPAA Security Rule (45 C.F.R. Part 164 Subpart C), GLBA Safeguards Rule (16 C.F.R. Part 314), FTC Act § 5 unfair/deceptive practices, NYDFS Part 500, GDPR, NIS2, DORA, and SEC cybersecurity disclosure rules.
- Frameworks and certifications are usually voluntary or contractual: NIST CSF, ISO/IEC 27001, SOC 2, PCI DSS. PCI DSS is mandatory by contract for card acceptance, not by general statute. A SOC 2 report is an attestation, not a certification of legal compliance.
- Sector and data scope drive applicability: PHI for HIPAA, nonpublic personal information for GLBA, education records for FERPA, cardholder data for PCI DSS, covered cyber incidents for CIRCIA reporting (when final rule applies).
Building defensible compliance
- Inventory data, systems, vendors, and data flows; map each obligation to owner, control, evidence, and review frequency.
- Use a risk-based gap assessment. "Reasonable security" is contextual: sensitivity, size, threats, cost, and feasibility.
- Flow down duties in contracts: business associate agreements, data processing agreements, SCCs/BCRs/DPF for transfers, breach notice, audit rights, subprocessor approval.
- Keep evidence: policies, training records, access reviews, vulnerability scans, pen-test reports, incident logs, vendor assessments, management approvals.
Worked example
A U.S. medical-billing SaaS company handles PHI for hospital clients and stores card data for patient payments. HIPAA applies directly to the covered entities and to the vendor as a business associate; a BAA is required, and the Security Rule controls apply. PCI DSS applies through acquiring-bank contracts. SOC 2 may satisfy customer assurance but does not replace HIPAA. GDPR may apply if it markets to EU patients or monitors their behavior. The exam answer should name each trigger separately.
Traps
- Saying "we are ISO 27001 certified, so we are compliant" - certification scope may exclude systems or legal duties.
- Citing NIST as law.
- Missing vendor flow-down and subprocessor duties.
- Treating encryption as a universal safe harbor; breach laws differ.
- Producing policies without evidence of operation.