Regulations, Standards, and Compliance
Compliance as evidence
This domain asks whether you understand that compliance means demonstrating adherence to obligations through documented controls, testing, and records - not merely asserting it. Know the difference between a regulation (legally enforceable), a standard (a defined, often mandatory requirement), and a framework (a structured approach used to meet obligations).
Scope and obligations
Candidates should be able to reason about scope (which data, systems, and people are covered), data classification (public, internal, confidential, restricted), and retention obligations. Understand that privacy obligations typically attach to personal data and follow it across systems and vendors, and that third-party relationships extend accountability even when operations are outsourced.
Traps to watch
- Equating compliance with security; an organization can be compliant and still be exposed.
- Assuming a certification is permanent - it requires surveillance and renewal.
- Forgetting that outsourced processing does not outsource accountability.
- Confusing retention (keep for a period) with deletion (remove when no longer needed); both can be obligations.
- Overlooking that scope changes when data moves to a new environment.
Rule of thumb
For compliance items, ask: What obligation, whose data, what evidence? If a choice cannot produce evidence, it is probably wrong.
Worked example
A vendor stores customer records. The organization remains accountable for protection, so it needs contractual terms, a defined scope, and audit rights. If the vendor later moves data to a new region, scope must be reassessed and evidence updated - the obligation did not change, but the demonstration of compliance did.