Security compliance
Exam objective 5.4: Summarize elements of effective security compliance.
On this page
Compliance means meeting the laws, regulations, and contracts that apply. This objective covers internal and external reporting, consequences of non-compliance, monitoring, attestation, automation, and privacy concepts such as data subject rights and the right to be forgotten.
Reporting and consequences
Compliance reporting can be internal (to management and the board) or external (to regulators and customers). Consequences of non-compliance include fines, sanctions, reputational damage, loss of license, and contractual impacts.
| Consequence | Example |
|---|---|
| Fines | A regulator penalizes a company for a privacy violation |
| Sanctions | Restrictions imposed by a government or industry body |
| Reputational damage | Customers leave after a public breach |
| Loss of license | Permission to operate is revoked |
| Contractual impacts | A partner terminates or penalizes under contract |
Monitoring and privacy
Compliance monitoring includes due diligence and due care, attestation and acknowledgment (formal statements that rules are followed), internal and external checks, and automation. Privacy covers legal implications at local, national, and global levels; data subjects (the people the data describes); controller and processor roles; ownership; the data inventory and retention; and the right to be forgotten (asking for one's personal data to be erased).
Key terms
- Attestation
- A formal statement, usually signed, confirming that requirements are being met.
- Right to be forgotten
- A person's right to have their personal data erased when it's no longer needed or consent is withdrawn.
- Data subject
- The individual whom personal data is about.
- Data inventory
- A record of what data an organization holds, where it is, and why.
- Due care
- Taking reasonable, ongoing steps to protect assets and meet obligations.
- Regulatory fines
- Monetary penalties imposed by regulators for failing to meet legal requirements.
- Loss of license
- Losing legal permission to operate or offer a service because of non-compliance.
- Contractual impacts
- Penalties or termination under contracts when compliance obligations aren't met.
- Compliance automation
- Using tools to continuously check and report on compliance controls.
- External compliance reporting
- Reporting compliance status to regulators, customers, or other outside parties.
- Sanctions
- Penalties or restrictions imposed by governments or industry bodies for violations.
Check yourself
22 practice questions on this objective
Practice this objectiveFlashcards for this objective