Compliance
Compliance is demonstrated adherence to laws, regulations, standards, and contracts. The exam tests whether you can tell compliance apart from security, match obligations to frameworks, and choose evidence that an auditor would accept.
Core rules
- Hierarchy: policies state management intent; standards set mandatory requirements; procedures give step-by-step instructions; guidelines are recommendations. Baselines are minimum configurations derived from standards.
- Key frameworks: NIST Cybersecurity Framework (Govern, Identify, Protect, Detect, Respond, Recover), NIST RMF and SP 800-53 controls, ISO/IEC 27001 for an ISMS and 27002 for control guidance, CIS Controls, and COBIT for IT governance.
- SOC reports: SOC 1 covers controls relevant to financial reporting, SOC 2 covers security, availability, processing integrity, confidentiality, and privacy using trust services criteria, and SOC 3 is a public summary. SOC 2 is an attestation report, not a certification.
- PCI DSS applies to the cardholder data environment: 12 requirements cover network security, encryption, access control, monitoring, testing, and policy. Segmentation and tokenization shrink scope; a self-assessment questionnaire (SAQ) fits lower-volume merchants.
- Privacy: GDPR uses controller and processor roles, lawful basis, data minimization, purpose limitation, storage limitation, data subject rights, a 72-hour breach notification to the supervisory authority, DPIAs for high-risk processing, and transfer safeguards. HIPAA has Privacy and Security Rules plus breach notification; a business associate agreement is required with vendors handling PHI.
- SOX addresses internal controls over financial reporting; GLBA covers financial institutions' consumer data; FERPA protects education records.
Worked example
A retailer wants to reduce PCI DSS scope. It segments the cardholder data environment behind a firewall, tokenizes card numbers so the order system stores only non-sensitive tokens, and restricts administrative access with MFA. The auditor samples firewall rules, tokenization data flow, and access reviews. Reasoning: scope reduction is a design change plus evidence, not a policy statement; if card data still flows through the order system, scope returns.
Traps that cost marks
An ISO/IEC 27001 certificate does not by itself prove GDPR compliance; compliance is point-in-time and continuous monitoring matters; 'HIPAA certified' is not a real status; a SOC 2 report with a qualified opinion has exceptions you must read; passing an audit does not mean no incidents occurred.