Security Program Management and Oversight · Topic 5 of 7
Compliance and Privacy
Security+ compliance and privacy: reporting, penalties for non compliance, due care, attestation, GDPR, HIPAA, PCI DSS, data subjects and retention.
- 4 min
- Compliance covers laws, regulations, industry standards and contracts.
- Consequences include fines, sanctions, reputational damage, loss of license and contractual penalties.
- Due diligence is research and planning, and due care is carrying it out responsibly.
What it is
Compliance means meeting the requirements of laws, regulations, industry rules and contracts. Privacy is the protection of personal information and the rights of the people it describes.
Failing to comply can be costly, so organizations build monitoring and reporting into their security programs. Privacy rules add specific duties for how personal data is collected, used, kept and deleted.
How it works
Compliance reporting
Reports show whether requirements are met. Internal reports go to management and committees, while external reports go to regulators, auditors, customers or partners. Reports should be accurate, timely and based on evidence.
Consequences of non-compliance
| Consequence | Meaning |
|---|---|
| Fines | Financial penalties set by a regulator |
| Sanctions | Formal restrictions or penalties, which may be legal or trade related |
| Reputational damage | Loss of trust among customers and partners |
| Loss of license | Loss of the legal right to operate in a field |
| Contractual impacts | Breach of agreements, loss of contracts or penalty payments |
Compliance monitoring
Monitoring checks continually that rules are followed.
| Element | Meaning |
|---|---|
| Due diligence and due care | Due diligence is investigating and planning. Due care is acting responsibly to carry out the plan |
| Attestation and acknowledgement | Written confirmation by staff or managers that they follow or understand the rules |
| Internal and external monitoring | Checks by the organization and by outside parties |
| Automation | Tools that collect evidence and test controls on a schedule |
Automation reduces manual effort and gives a more current picture than occasional reviews.
Well known requirements
Some regulations come up often.
The General Data Protection Regulation (GDPR) protects personal data of people in the European Union. The Health Insurance Portability and Accountability Act (HIPAA) covers health information in the United States. The Payment Card Industry Data Security Standard (PCI DSS) is an industry standard for organizations that handle payment card data.
Knowing which rule applies depends on the type of data, the location of the data and the people it describes.
Privacy
| Term | Meaning |
|---|---|
| Data subject | The person whom the personal data is about |
| Controller | The party that decides why and how personal data is processed |
| Processor | The party that processes data for the controller |
| Data inventory and retention | A record of what personal data is held and for how long |
| Right to be forgotten | A person's right, under some laws, to ask for personal data to be erased |
| Ownership | Who is accountable for the data, which affects who decides about it |
Privacy laws can apply at local, regional, national and global levels, and one organization may have to meet several at once. Legal implications depend on where the data subjects live and where the data is stored or processed.
Building a data inventory
A data inventory is the base for privacy compliance. It lists what personal data is collected, why, where it is kept, who can see it and when it should be deleted. Without it, a deletion request cannot be fully honored.
What to remember for the exam
- Compliance covers laws, regulations, industry standards and contracts.
- Consequences include fines, sanctions, reputational damage, loss of license and contractual penalties.
- Due diligence is research and planning, and due care is carrying it out responsibly.
- Attestation is a signed confirmation that rules are followed or understood.
- Automation makes compliance monitoring more continuous.
- GDPR protects personal data of people in the EU, HIPAA covers US health information and PCI DSS covers payment card data.
- The data subject is the person the data is about.
- A data inventory and retention schedule are needed to meet privacy duties.
For a question about a person asking a company to erase their personal data, think right to be forgotten, data subject, controller and processor.
Common mistakes
Believing that compliance equals security. Meeting a minimum standard does not mean the organization is safe from every threat.
Mixing up due diligence and due care. Diligence is the investigation and planning. Care is the responsible action that follows.
Forgetting the processor. A vendor that handles data for you has duties too, and the controller must manage that relationship.
Ignoring where the data lives. Storing data in another country can bring in extra laws.
Skipping the data inventory. You cannot report on or delete data that you do not know you hold.
Do not apply one rule to all data. Regulated data, such as payment card or health data, may need extra controls that ordinary data does not.
Check yourself
Who is the data subject?
The person whom the personal data is about.
What is the difference between due diligence and due care?
Due diligence is investigating and planning, and due care is acting responsibly to carry out the plan.
Which standard applies to organizations that handle payment card data?
The Payment Card Industry Data Security Standard (PCI DSS).
Topic 5 of 7 in Security Program Management and Oversight
Test yourself on Security Program Management and Oversight
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.