CoreQ Academy5.4 Summarize elements of effective security compliance.
Compliance means proving you meet legal, regulatory and contractual requirements, and keeping it that way. Privacy law adds specific duties to protect personal data and respect individual rights.
Compliance reporting
- Internal
- Reporting to management and the board on compliance status.
- External
- Reporting to regulators, auditors or customers.
Consequences of non-compliance
- Fines
- Monetary penalties from regulators.
- Sanctions
- Restrictions imposed by regulators or governments.
- Reputational damage
- Loss of customer and partner trust.
- Loss of license
- Losing the right to operate or to process certain data, such as card payments.
- Contractual impacts
- Breach of contract, lost customers or penalties.
Compliance monitoring
- Due diligence/care
- Due diligence is investigating and understanding risks; due care is acting reasonably to address them.
- Attestation and acknowledgement
- People formally confirm they have read and will follow policies; managers attest that controls are in place.
- Internal and external
- Monitoring by your own teams and by independent parties.
- Automation
- Tools that continuously check controls and collect evidence.
Privacy
- Legal implications
- Privacy laws apply at local/regional, national and global levels and can conflict.
- Data subject
- The person the personal data is about.
- Controller vs. processor
- The controller decides purpose and means of processing; the processor processes on its behalf. Both have legal duties.
- Ownership
- Who is accountable for the data.
- Data inventory and retention
- Knowing what personal data you hold, where, and deleting it when no longer needed.
- Right to be forgotten
- A data subject's right (for example under GDPR) to have their personal data erased in certain circumstances.
Check your understanding
Knowledge quiz · pass mark 80%
- Which are consequences of non-compliance? (choose all)
- Under GDPR, the person whose data is processed is the:
- A payroll company processing salaries on behalf of a client is the:
- A customer asks for all their personal data to be deleted. This is the:
Original CoreQ Academy material, mapped to objective 5.4 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.