Compliance, Accreditation, and Legal/Regulatory Alignment
What the exam tests
Compliance questions test how obligations become controls and evidence: which law, regulation, or standard applies; how frameworks map to each other; how audit and accreditation work; and how legal, privacy, and contractual duties shape security operations.
Core rules
- Compliance is not security. An audit tests evidence of a control at a point in time; it does not prove the control resists attack.
- Certification vs. accreditation. A product or organization may be certified against a standard; accreditation (an authorization to operate) is the accountable authority's acceptance of residual risk for a system.
- Map once, reuse evidence. ISO/IEC 27001 Annex A, NIST SP 800-53, SOC 2 Trust Services Criteria, and PCI DSS overlap; a control matrix reduces duplicate audit effort and exposes gaps.
- Privacy and data residency: know where data is stored and processed, who the controller and processor are, and which transfer mechanism applies.
- Legal hold overrides routine deletion. Suspend retention schedules when litigation is reasonably anticipated; preserve metadata.
- Contracts allocate risk. Breach notification timelines, right-to-audit clauses, and subcontractor obligations belong in the security schedule.
Worked example
A SaaS provider must satisfy a customer demanding SOC 2 Type II, ISO/IEC 27001 certification, and GDPR assurances. Reasoning: do not commission three separate audits. Build a control matrix, map existing controls to all three, reuse access-review, change-management, and incident evidence, and identify gaps such as a missing documented data-processing agreement. Obtain the DPA and a valid transfer mechanism, then have the auditor test the mapped controls. The deliverable is one evidence set with three mappings.
Traps
- Treating a certificate as proof of effective security.
- Assuming one country's privacy law covers global processing.
- Deleting archives after a legal hold is issued.
- Confusing the data controller with the processor.
- Ignoring subcontractor flow-down obligations.