CoreQ Academy1.3 Explain how compliance affects information security strategies.
Compliance obligations set the floor for your security strategy and differ by sector and jurisdiction. Architects design once to satisfy many.
Industry-specific compliance
- Awareness of industry-specific compliance
- Knowing which rules apply to your sector.
- Healthcare
- e.g. HIPAA in the US for protected health information.
- Financial
- e.g. GLBA, SOX, banking regulators, PCI DSS for cards.
- Government
- e.g. FISMA, FedRAMP, CMMC for contractors.
- Utilities
- e.g. NERC CIP for the electric grid.
Industry standards
- Payment Card Industry Data Security Standard (PCI DSS)
- Required for organisations handling card data.
- International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27000 series
- Family including 27001 (certifiable ISMS) and 27002 (control guidance).
- Digital Markets Act (DMA)
- EU law regulating large "gatekeeper" platforms, including interoperability and data-use obligations.
Security and reporting frameworks
- Benchmarks
- Secure configuration baselines such as CIS Benchmarks.
- Foundational best practices
- Baseline controls that every program should have.
- System and Organization Controls 2 (SOC 2)
- Attestation report on service organisation controls.
- National Institute of Standards Technology Cybersecurity Framework (NIST CSF)
- Functions Govern, Identify, Protect, Detect, Respond, Recover (CSF 2.0).
- Center for Internet Security (CIS)
- Publisher of the CIS Critical Security Controls and Benchmarks.
- Cloud Security Alliance (CSA)
- Cloud Controls Matrix and STAR assurance program.
Audits vs. assessments vs. certifications
- Audits vs. assessments vs. certifications
- An audit formally tests compliance against criteria; an assessment evaluates posture more flexibly; a certification is formal recognition (e.g. ISO 27001) after an accredited audit.
- External
- Performed by independent outside parties.
- Internal
- Performed by the organisation's own staff or internal audit.
Privacy regulations
- General Data Protection Regulation (GDPR)
- EU privacy law with strong data subject rights, lawful bases, 72-hour breach notification and large fines.
- California Consumer Privacy Act (CCPA)
- California privacy law (amended by CPRA) giving consumers rights to know, delete and opt out of sale or sharing.
- General Data Protection Law (LGPD)
- Brazil's comprehensive privacy law, similar in structure to GDPR.
- Children's Online Privacy Act (COPPA)
- US law requiring verifiable parental consent before collecting personal data from children under 13.
Cross-jurisdictional compliance
- Awareness of cross-jurisdictional compliance requirements
- Data and operations crossing borders must satisfy several, sometimes conflicting, legal regimes.
- e-discovery
- Ability to find and produce electronic records for legal proceedings.
- Legal holds
- Preserving relevant data when litigation is anticipated.
- Due diligence
- Investigating and understanding risks before acting.
- Due care
- Acting reasonably and continuously to protect against those risks.
- Export controls
- Restrictions on exporting certain technologies, including some encryption, to certain countries or parties.
- Contractual obligations
- Security and privacy terms agreed with customers and partners.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 1.3 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.