Information Security, Privacy, and Regulatory Compliance
Security, privacy, and regulatory compliance test protection of office information and lawful handling of personal data. Expect the CIA triad, access control, encryption, phishing, incident response, privacy principles, and major regulatory obligations.
Core rules
- Confidentiality, integrity, and availability guide controls. Least privilege and need-to-know limit access; multi-factor authentication protects accounts; encryption protects data at rest and in transit.
- Classify data and apply handling rules by class. Retain only as long as needed, then dispose securely.
- Privacy principles include lawful basis, purpose limitation, data minimization, accuracy, storage limitation, and accountability. Individuals may have access, correction, and deletion rights.
- Incident response follows preparation, detection and analysis, containment, eradication, recovery, and lessons learned.
- Regulations differ: GDPR governs EU personal data with breach notification; HIPAA protects US health information; SOX addresses financial reporting controls; ISO 27001 is a management-system standard, not a law.
Worked example
A laptop with client names and account numbers is stolen. First contain: revoke credentials and remote-wipe if available. Then assess: if full-disk encryption was enabled and keys were not stored with the device, the likelihood of data compromise is lower, but the incident is still logged. Determine whether the data is personal data and whether a notifiable breach exists under the applicable regime; notify per policy and law, and preserve evidence. The reasoning separates security response from legal notification duties.
Traps
- Treating privacy and security as synonyms; privacy is about lawful and fair handling, security is about protection.
- Assuming a certification guarantees no breach; it evidences a management system.
- Keeping data indefinitely because storage is cheap.
- Sharing accounts or credentials, which destroys accountability.