Compliance and Regulation
Compliance is the state of meeting external obligations: laws, regulations, industry standards and contractual requirements. Regulation is the source of those obligations. This subcategory covers the frameworks, the mapping process, the audit cycle and the operational practices that keep an organization compliant without turning compliance into theatre.
Files
| # | File | Format |
|---|---|---|
| 01 | Compliance Fundamentals | Process-based |
| 02 | Regulatory Landscape | Process-based |
| 03 | Control Mapping and Frameworks | Process-based |
| 04 | Audit and Evidence Management | Process-based |
| 05 | Compliance Monitoring and Reporting | Process-based |
Certification Alignment
This subcategory maps to the following certifications:
- CISSP - Domain 1 (Security and Risk Management): legal and regulatory issues, compliance requirements.
- CISM - Domain 1 (Information Security Governance): compliance with external requirements.
- CISA - Domain 1 (Information System Auditing Process): audit standards and compliance.
- ISO 27001 LI/LA - Clauses 4-10, Annex A.5.31 (Legal, statutory, regulatory and contractual requirements).
See ../../CERTIFICATIONS.md for the full matrix.
Related
- 01 Governance and Frameworks
- 02 Risk Management
- 04 Security Policies and Standards (planned subcategory)
References
- ISO/IEC 27001:2022 - Information security management systems - https://www.iso.org/standard/27001
- NIST Cybersecurity Framework 2.0 - https://www.nist.gov/cyberframework
- NIST SP 800-53 Rev. 5 - Security and Privacy Controls - https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
- PCI Security Standards Council - https://www.pcisecuritystandards.org/
- ISACA - COBIT 2019 Framework - https://www.isaca.org/resources/cobit