SkarpChapter 25 of 27
Compliance, Legal, and Regulatory Requirements in Security Programs
Navigate the maze of laws, regulations, and standards that shape how organizations handle data, privacy, and incident reporting obligations.
Big Picture: Why Compliance Matters in Security
Security Compliance in Context
Security compliance aligns technical and administrative controls with external obligations (laws, regulations, contracts, standards) and internal policies.
Governance, Risk, and Compliance
Governance, risk, and compliance refers to operating with an awareness of applicable regulations and policies, including principles of governance, risk, and compliance when securing enterprise environments.
Rules vs Frameworks vs Controls
- Laws/regulations: you must do X
- Standards/frameworks: structured ways to do X
- Controls: concrete mechanisms (MFA, logging, encryption) that implement X
Link to Risk Management
Risk management decides which risks to treat. Compliance adds non‑negotiable requirements: some controls are required even if risk seems low.
Exam Angle
Expect scenario questions asking which laws, regulations, or standards drive security choices like logging, encryption, and incident reporting.
Key Legal and Regulatory Drivers (Global View, 2026)
Why Regulations Matter
Know categories of regulations and how they shape controls, rather than memorizing every article or section number.
Data Protection & Privacy
GDPR, CCPA/CPRA, and similar laws drive lawful processing, data minimization, user rights, and strict breach notification rules.
Sector-Specific Rules
HIPAA governs health data safeguards; GLBA requires financial institutions to secure customer information via formal programs.
Cyber & Critical Infrastructure
Laws such as EU NIS2 set minimum security and incident reporting for critical sectors and essential services.
Breach Notification Trends
Most modern laws require timely breach notification with specific content and recipients, driving logging and incident response.
Standards, Frameworks, and Contracts as Compliance Drivers
Beyond Laws: Other Drivers
Compliance is also driven by industry standards, security frameworks, and contractual obligations, not just formal laws.
Industry Standards: PCI DSS
PCI DSS is a card-brand standard requiring controls like segmentation, encryption, and logging for cardholder data environments.
Security Frameworks
Frameworks like ISO/IEC 27001 and NIST CSF organize best-practice controls and processes, often used to structure security programs.
Contracts and SLAs
Contracts with cloud and SaaS providers often specify encryption, logging, incident notification timelines, and audit rights.
Exam Signal
If you see PCI DSS, think industry standard; if you see SLA notification timelines, think contractual compliance requirement.
Data Types, Privacy, and Handling Requirements
Why Data Type Matters
Different laws and standards apply to different data types, so classification is the first step in mapping compliance to controls.
PII and Sensitive PII
PII identifies a person; sensitive PII (like health or biometric data) typically requires stronger protections and stricter consent.
PHI and Health Data
PHI is health-related PII in a medical context, driving HIPAA-style safeguards like strict access control, logging, and encryption.
Financial and Cardholder Data
Financial data may fall under GLBA; cardholder data is governed by PCI DSS, requiring strong segmentation and encryption.
Privacy-Driven Controls
Common controls: data minimization, least privilege, encryption, logging, and secure retention/disposal policies.
Worked Scenarios: Mapping Regulations to Controls
Scenario 1: EU E‑commerce
US company selling to EU customers triggers GDPR: consent for tracking, privacy notices, data subject rights, and breach notification.
Scenario 1: Controls
Map to cookie consent tools, access control and encryption for PII, data inventory, and incident response with GDPR steps.
Scenario 2: Hospital Hybrid Environment
Hospital using on‑prem EHR plus cloud imaging: hybrid environment subject to HIPAA and local health privacy laws.
Scenario 2: Controls
Controls: BAAs, encrypted links, RBAC for PHI, centralized logging, and clear breach notification playbooks.
Scenario 3: Online Retailer
Retailer accepting credit cards must follow PCI DSS, focusing on protecting cardholder data and limiting scope.
Scenario 3: Controls
Use PCI-compliant payment gateways, segment networks, and run regular vulnerability scans and web app firewalls.
The Audit Process and Evidence: What Auditors Look For
Audit Lifecycle
Audits move through planning and scoping, evidence collection, reporting, and remediation/follow-up stages.
Scope and Controls
Scoping defines which systems and processes are in; auditors then focus on relevant controls like firewalls or encryption.
Evidence Types: Documents
Policies, procedures, and records (like training logs and risk assessments) support administrative controls.
Evidence Types: Technical
Screenshots, configuration exports, and logs demonstrate that technical controls are implemented and operating.
What Makes Good Evidence
Good evidence is reliable, objective, and repeatable, such as signed access reviews or SIEM logs, not just verbal claims.
Mapping Requirements to Controls: A Practical Method
Step 1: Identify the Driver
Determine whether the requirement comes from a law, industry standard, framework, or contract/SLA.
Step 2: Extract the Objective
Ask what the rule tries to achieve: confidentiality, integrity, availability, accountability, or user rights.
Step 3: Control Families
Map the objective to administrative, technical, and physical control families.
Step 4: Concrete Controls
Translate requirements like limited PHI access into RBAC, MFA, policies, and access logs.
Step 5: Monitoring & Evidence
Always ask how you will prove the control works: logs, reports, tickets, and sign-offs.
Thought Exercise: Map These Requirements
Work through these short exercises to practice mapping requirements to controls. Think in terms of driver → objective → controls → evidence.
Exercise 1
"A new state law requires organizations to notify affected individuals within 30 days of discovering a breach involving their PII."
- What is the compliance driver? (Law, standard, framework, or contract?)
- What is the security objective?
- Name two controls (at least one administrative, one technical) that support this requirement.
- What evidence could you show an auditor?
Pause and answer before reading the sample answer.
Sample reasoning:
- Driver: Law (state breach notification law).
- Objective: Transparency and accountability after incidents.
- Controls:
- Administrative: Incident response policy with a 30‑day notification step.
- Technical: Centralized logging and alerting to detect breaches quickly.
- Evidence: Incident response plan document, IR playbooks, past incident tickets showing timelines, SIEM alert configuration.
Exercise 2
"Your company signs a contract with a customer that says: 'All customer data must be encrypted at rest and in transit.'"
- Driver?
- Objective?
- Two controls (technical/administrative)?
- Evidence?
Sample reasoning:
- Driver: Contract (SLA/security addendum).
- Objective: Confidentiality of customer data.
- Controls:
- Technical: Database encryption at rest; TLS for APIs and web apps.
- Administrative: Encryption standard documented in security policy and design reviews.
- Evidence: Screenshots or configs showing encryption settings, TLS certificates, policy documents, architecture diagrams.
Use this same reasoning pattern during the mock exams in this course. It will make many compliance questions feel like structured puzzles instead of guesswork.
Quick Check: Compliance Drivers and Controls
Test your understanding of how different requirements map to controls.
A company processes online payments but outsources all card handling to a third-party payment gateway. The gateway requires the company to maintain a secure web application and perform regular vulnerability scans. What is the PRIMARY compliance driver for these specific security requirements?
- A national cybersecurity law
- An industry standard imposed through contracts (PCI DSS)
- An internal security framework like NIST CSF
- A voluntary code of ethics
Show Answer
Answer: B) An industry standard imposed through contracts (PCI DSS)
The situation describes a payment context and requirements coming from the payment gateway. These are driven by PCI DSS, an industry standard that is enforced contractually. National laws may apply too, but the explicit requirements in the scenario are best explained by PCI DSS obligations passed through contracts.
Quick Check: Audit Evidence
Another short quiz to reinforce audit and evidence concepts.
An auditor asks you to prove that multi-factor authentication (MFA) is enforced for all remote administrative access. Which of the following is the MOST appropriate evidence?
- A verbal statement from the security manager confirming MFA is required
- A copy of the organization's acceptable use policy mentioning MFA
- Screenshots or configuration exports from the VPN and admin portals showing MFA is enabled, plus recent authentication logs
- A list of all administrators and their job titles
Show Answer
Answer: C) Screenshots or configuration exports from the VPN and admin portals showing MFA is enabled, plus recent authentication logs
Auditors want objective, technical evidence that controls are implemented and operating. Config screenshots/exports showing MFA settings plus recent authentication logs directly prove enforcement. Policies and verbal statements are supporting evidence but not sufficient by themselves.
Flashcards: Core Compliance and Audit Terms
Use these flashcards to reinforce key terms that often appear in Security+ scenarios.
- CompTIA Security+
- CompTIA Security+ is a global certification that validates the baseline skills necessary to perform core security functions and pursue an IT security career.
- SY0-701
- SY0-701 is the exam series code for the latest version (V7) of the CompTIA Security+ certification exam.
- governance, risk, and compliance
- Governance, risk, and compliance refers to operating with an awareness of applicable regulations and policies, including principles of governance, risk, and compliance when securing enterprise environments.
- Personally Identifiable Information (PII)
- Information that can be used to identify an individual, such as name, address, email, ID numbers; often subject to privacy and data protection laws.
- Protected Health Information (PHI)
- Health-related PII associated with the provision of healthcare or payment for healthcare services, protected under laws such as HIPAA.
- PCI DSS
- Payment Card Industry Data Security Standard: an industry standard, enforced via contracts, that defines security requirements for organizations that store, process, or transmit cardholder data.
- Audit evidence
- Documents, configurations, logs, and records that demonstrate a control is properly designed and operating effectively over time.
- Breach notification
- A legal or contractual requirement to inform regulators, customers, or partners about certain security incidents within defined timeframes.
- Data minimization
- A privacy principle requiring organizations to collect, process, and retain only the personal data necessary for a specific purpose.
- Hybrid environment
- A hybrid environment is an enterprise environment that includes a mix of cloud, mobile, Internet of Things (IoT), operational technology (OT), and on-premises resources that must be monitored and secured.
Key Terms
- PHI
- Protected Health Information; health-related PII in a medical context, protected by laws such as HIPAA.
- PII
- Personally Identifiable Information; any data that can be used to identify an individual, often subject to privacy laws.
- Audit
- A formal, structured review to determine whether controls are designed appropriately and operating effectively to meet requirements.
- PCI DSS
- Payment Card Industry Data Security Standard; an industry standard that defines security requirements for organizations handling cardholder data.
- SY0-701
- SY0-701 is the exam series code for the latest version (V7) of the CompTIA Security+ certification exam.
- Audit evidence
- Objective information such as policies, configurations, logs, and records used to demonstrate that controls are in place and functioning.
- CompTIA Security+
- CompTIA Security+ is a global certification that validates the baseline skills necessary to perform core security functions and pursue an IT security career.
- Data minimization
- A principle requiring organizations to collect and retain only the data necessary for a defined purpose.
- Hybrid environment
- A hybrid environment is an enterprise environment that includes a mix of cloud, mobile, Internet of Things (IoT), operational technology (OT), and on-premises resources that must be monitored and secured.
- Breach notification
- The process, often legally required, of informing regulators, individuals, or partners about a security breach within a specified timeframe.
- governance, risk, and compliance
- Governance, risk, and compliance refers to operating with an awareness of applicable regulations and policies, including principles of governance, risk, and compliance when securing enterprise environments.