Compliance, Legal, and Regulatory Considerations
Domain 8 tests how legal and regulatory obligations interact with risk management. Expect questions on compliance as a baseline, cross-border data, and evidence.
Core rules
- Compliance is mandatory adherence to laws, regulations, contracts, and standards; risk management also considers voluntary and strategic risk.
- Identify obligations, map them to controls, and retain evidence; a control that satisfies one regime may not satisfy another.
- Regulatory risk includes fines, license loss, litigation, and reputational damage; likelihood and impact vary by jurisdiction.
- Cross-border transfers require a lawful mechanism and a transfer impact assessment in many regimes.
- Monitor regulatory change and treat new obligations as changes to the risk context.
Worked example
A U.S. healthcare analytics firm sends patient data to a processor in the EU. GDPR applies to the EU processor, HIPAA applies to the U.S. covered entity, and the transfer needs a valid mechanism plus a transfer impact assessment. The team maps HIPAA safeguards and GDPR processor terms to one control set, identifies gaps in deletion evidence, and assigns an owner. The reasoning does not assume that HIPAA compliance satisfies GDPR; it maps each obligation separately and reconciles controls.
Traps
- Treating compliance as complete risk management.
- Assuming one jurisdiction's rules apply everywhere.
- Confusing PCI DSS, a contractual standard, with a statute.
- Missing evidence that controls operate, not just exist.