Network Defense Management · Topic 4 of 5
Compliance, Regulations and Security Policies
Know the key laws and standards (PCI DSS, HIPAA, SOX, GLBA, GDPR, ISO 27001) and how to design security policies, including the four EC-Council types.
- 4 min
- HIPAA is health, SOX is financial reporting, GLBA is financial customer data, GDPR is EU privacy.
- PCI DSS is an industry standard backed by the card brands, not a statute.
- ISO 27001 is the certifiable ISMS standard, and ISO 27002 is the control guidance.
What it is
Compliance means meeting the requirements of laws, regulations and standards that apply to the organization. A security policy is the written statement of management's rules for protecting information. Policies are how a company turns legal and business requirements into daily practice.
The exam asks you to match a law to its subject, and to recognize the parts and types of a security policy.
How it works
Obtaining compliance
A practical compliance process looks like this.
- Identify which laws and standards apply, based on industry, data type and region.
- Assess current controls against the requirements to find gaps.
- Implement controls and write the policies and procedures.
- Document evidence, such as logs, reports and approvals.
- Audit and review regularly, internally and by outside auditors.
Compliance is a minimum floor. An organization can be compliant and still be breached.
Regulatory frameworks, laws and acts
| Law or standard | Area | Key point |
|---|---|---|
| PCI DSS | Payment cards | Industry standard (not a law) for storing, processing or sending cardholder data. Has twelve main requirements. |
| HIPAA | US healthcare | Protects protected health information (PHI) |
| SOX (Sarbanes-Oxley) | US public company finance | Accurate financial reporting and internal controls |
| GLBA | US financial institutions | Protects customers' private financial data |
| FISMA | US federal agencies | Information security programs for federal systems |
| GDPR | European Union | Privacy and data protection for people in the EU |
| DPA 2018 | United Kingdom | UK data protection law working with UK GDPR |
| FERPA | US education | Student education records |
| DMCA | US copyright | Protects copyrighted digital works |
| CCPA | California | Consumer privacy rights |
| ISO/IEC 27001 | International | Requirements for an information security management system (ISMS) |
| ISO/IEC 27002 | International | Guidance on security controls |
| NIST Cybersecurity Framework | US, widely used | Functions such as Identify, Protect, Detect, Respond and Recover |
| COBIT | IT governance | Governance and management of enterprise IT |
GDPR needs a lawful basis for processing personal data, grants rights such as access and erasure, and requires breach notification to the supervisory authority within 72 hours. The largest fines reach 20 million euros or 4 percent of worldwide annual turnover, whichever is higher.
ISO 27001 is certifiable, so an organization can be audited and certified. ISO 27002 is guidance and is not certified on its own.
Designing and developing security policies
A good policy is clear, approved by management, enforceable and reviewed on a schedule. It states purpose, scope, roles, rules, and the consequence of breaking them.
Policy documents form a hierarchy.
- Policy: high level management intent.
- Standard: mandatory specific requirements, such as a minimum password length.
- Guideline: recommended practice.
- Procedure: step by step instructions.
Four security policy types in EC-Council terms, from open to strict:
| Type | Idea |
|---|---|
| Promiscuous | No restriction. Everything is allowed. |
| Permissive | Most things allowed, with known dangerous ones blocked |
| Prudent | Most things blocked, with services opened deliberately |
| Paranoid | Everything forbidden. Strongest and least usable. |
Common policy topics: acceptable use, access control, password, email, remote access, BYOD, data classification and retention, incident response, backup, change management and physical security.
Design steps: perform a risk assessment, involve stakeholders, draft, review with legal and human resources, get management approval, publish and train, enforce, and review at least yearly or after major change.
A worked example
A company starts to accept card payments on its website. Its legal team notes PCI DSS applies, and its European customers bring GDPR into scope.
The security manager runs a gap assessment, writes a password policy and a data retention policy, limits who can see cardholder data, and plans an annual audit. The company chooses a prudent stance: traffic and access are blocked unless a business reason exists.
How the exam asks about this
- "Which law protects protected health information in the United States?" → HIPAA.
- "Which security policy type blocks most services and opens only those needed?" → Prudent.
- "Which standard governs card data handling?" → PCI DSS.
What to remember for the exam
- HIPAA is health, SOX is financial reporting, GLBA is financial customer data, GDPR is EU privacy.
- PCI DSS is an industry standard backed by the card brands, not a statute.
- ISO 27001 is the certifiable ISMS standard, and ISO 27002 is the control guidance.
- Policy types in order: promiscuous, permissive, prudent, paranoid.
- Policy sets intent, standards set mandatory detail, procedures give the steps.
Do not choose the paranoid policy as a normal answer. It is the most secure on paper, but it blocks the business, so a prudent policy is usually the practical choice.
Common mistakes
Calling PCI DSS a law. It is a contractual standard set by the payment card industry, though failing it brings fines and loss of card processing.
Mixing policy with procedure. A policy says what must be done and why. A procedure says exactly how.
Treating compliance as security. Passing an audit shows minimum controls exist, not that the network is safe.
Check yourself
Which law requires breach notification to the authority within 72 hours?
The GDPR.
What is the difference between a standard and a guideline?
A standard is mandatory, and a guideline is a recommended practice.
Which policy type allows everything with no restrictions?
Promiscuous.
Topic 4 of 5 in Network Defense Management
Test yourself on Network Defense Management
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.