Governance, Risk, and Compliance · Topic 5 of 7
Compliance and Regulations
See how laws, standards and contracts shape security strategy, including GDPR, HIPAA, PCI DSS, SOX, data sovereignty, audits, attestation and legal hold.
- 5 min
- Regulations are binding, while frameworks and benchmarks are voluntary unless adopted.
- PCI DSS is an industry standard enforced through contracts with card brands and acquirers.
- GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a breach, where the breach poses risk.
What it is
Compliance means meeting the requirements set by laws, regulations, industry standards and contracts. These requirements are external to the organization's own risk appetite, so they act as a floor under security design.
You do not need to memorize every clause. You need to recognize which obligation a scenario triggers and how it changes decisions about where data lives, what is kept, who is told, and how controls are proven.
How it works
Common regimes
| Regime | Applies to | Key idea |
|---|---|---|
| General Data Protection Regulation (GDPR) | Personal data of people in the European Union | Lawful basis, data subject rights, breach notification to the authority within 72 hours |
| Health Insurance Portability and Accountability Act (HIPAA) | US healthcare entities and their business associates | Protects health information |
| Payment Card Industry Data Security Standard (PCI DSS) | Anyone who stores, processes or transmits payment card data | A contractual industry standard, not a law |
| Sarbanes-Oxley Act (SOX) | US publicly traded companies | Controls over financial reporting |
| Gramm-Leach-Bliley Act (GLBA) | US financial institutions | Safeguarding customer financial information |
| California Consumer Privacy Act (CCPA) | Personal data of California residents | Consumer rights over personal data |
| Federal Risk and Authorization Management Program (FedRAMP) | Cloud services sold to US federal agencies | Standard security assessment of cloud providers |
An organization often faces several at once, so controls are mapped to all of them in a governance, risk and compliance (GRC) tool. When two requirements conflict, the stricter one usually wins unless counsel says otherwise.
Frameworks versus regulations
Regulations are legally binding. Frameworks and benchmarks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), the International Organization for Standardization and International Electrotechnical Commission (ISO/IEC) 27001 standard or the Center for Internet Security (CIS) benchmarks, are voluntary guides unless a contract or regulator adopts them. The exam often asks you to tell which one is mandatory in a scenario.
Data location and sovereignty
Data sovereignty means data is subject to the laws of the country where it is stored or collected. Data residency is the narrower requirement that data physically stays in a place. Both affect cloud region choice, backup location, support staff access and transfers across borders.
Cross border transfers may need a legal mechanism, and some laws limit where certain data may go. A global company must design for each jurisdiction, for example by keeping regional data stores.
Privacy
Privacy laws grant data subjects rights such as access, correction and deletion. Organizations need to know what personal data they hold, why, and for how long. A data protection officer (DPO) advises on privacy law for organizations where it is required.
A data protection impact assessment (DPIA) evaluates privacy risk before a new high risk processing activity starts. Data minimization and purpose limitation support compliance by reducing what is collected and how it is used.
Audits, assessments and attestation
| Term | Meaning |
|---|---|
| Internal audit | Performed by the organization's own staff to check readiness |
| External audit | Performed by an independent party and carries more credibility |
| Assessment | A review of controls against a standard, which may not produce a formal opinion |
| Attestation | A formal statement by a qualified party that controls meet criteria |
| Certification | An accredited body confirms conformity with a standard such as ISO/IEC 27001 |
Evidence matters as much as the control. If you cannot show logs, tickets or screenshots, an auditor treats the control as absent.
Legal and due care concepts
Due diligence is the research done before acting. Due care is acting responsibly and consistently afterwards.
A legal hold preserves data when litigation is expected, and e-discovery is the process of finding and producing electronic evidence. Failure to comply can mean fines, loss of the right to process cards, civil liability or contract termination.
What to remember for the exam
- Regulations are binding, while frameworks and benchmarks are voluntary unless adopted.
- PCI DSS is an industry standard enforced through contracts with card brands and acquirers.
- GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a breach, where the breach poses risk.
- Data sovereignty means local law follows the data, so region choice is a compliance decision.
- Cross border transfers can be restricted, which affects backups and support access.
- External audits and independent attestation carry more weight than self assessment.
- Controls need evidence, such as logs, tickets and approvals.
- A legal hold overrides deletion until released.
When a scenario names a data type (cardholder, health, EU personal data), identify the regime first, then pick the control that satisfies it.
Common mistakes
Treating compliance as security. Meeting a checklist does not mean the organization is secure, and a secure design can still fail an audit if evidence is missing.
Assuming one region covers all rules. Hosting in one country does not remove duties owed to people elsewhere.
Confusing sovereignty and residency. Residency is where data sits. Sovereignty is whose law applies.
Overlooking the processor. A cloud or service provider that handles personal data brings its own duties and needs a contract.
Exam questions test which regime a scenario triggers and what it requires, not fine amounts. Focus on the principle each regime applies.
Check yourself
Work through these three questions.
Which of these is an industry standard rather than a law: PCI DSS or HIPAA?
PCI DSS, which is enforced through contracts with payment brands, while HIPAA is a US law.
Why does data sovereignty affect cloud design?
The laws of the country where data is stored apply to it, so region, backup and support locations must be chosen to comply.
What does a legal hold do?
It preserves relevant data and suspends normal deletion until the hold is released.
Topic 5 of 7 in Governance, Risk, and Compliance
Test yourself on Governance, Risk, and Compliance
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.