5.4 Summarize elements of effective security compliance

Domain 5: Security Program Management and Oversight

Compliance is about proving the organization meets internal and external obligations, and this objective splits into reporting and monitoring on one side and privacy on the other. Know internal versus external compliance reporting, and the consequences of failure: fines, sanctions, reputational damage, loss of license, and contractual impacts. Monitoring includes due diligence and due care, attestation and acknowledgement, internal and external review, and automation of compliance checks. On privacy, learn the legal implications at local, national, and global levels, and the key vocabulary: data subject, controller versus processor, data ownership, data inventory and retention, and the right to be forgotten. Due care versus due diligence is a perennial trap — diligence is the research and investigation, care is acting reasonably on what you learned. Candidates also conflate compliance with security; the exam expects you to know that meeting a compliance bar is evidence for auditors and regulators, while controls still need to be validated as actually effective. Attestation questions hinge on someone formally asserting that requirements are met.

common pitfall · Candidates invert due care and due diligence, forgetting that diligence is investigating obligations while care is acting reasonably on them.