Governance and Compliance
86 cards · 8 sections
Governance (OBJ 5.1)
Guidelines
Recommended, non-mandatory approaches to handling specific situations; provide direction and best practices without requiring strict compliance. Distinguished from standards, which are mandatory.
Governance Monitoring
Regular review and assessment of a governance framework's effectiveness to identify gaps or weaknesses arising from changes in technology, regulations, or industry culture.
Governance Revision
Updating the governance framework — including policies, standards, procedures, and IT infrastructure — to address gaps or weaknesses identified during monitoring.
Four Purposes of Governance
- Risk Management — identify, assess, and manage potential risks that could impact organizational security
- Strategic Alignment — ensure IT strategy aligns with overall business objectives
- Resource Management — enable efficient and effective use of IT resources
- Performance Measurement — establish mechanisms to monitor and measure IT process performance
Governance as the First GRC Component
Governance is the first element of GRC (Governance, Risk, and Compliance). It provides the strategic leadership, structures, and processes that ensure an organization's IT infrastructure aligns with business objectives — covering risk management, resource allocation, and performance measurement.
Four Governance Outputs
- Guidelines — recommended (non-mandatory) approaches; provide direction without requiring compliance
- Policies — high-level commitments outlining the organization's intentions (e.g., data protection, ethical conduct)
- Standards — specific mandatory rules that must be followed to satisfy a policy; defined by industry or regulatory bodies
- Procedures — detailed step-by-step instructions for accomplishing specific tasks in compliance with policies and standards
Drivers for Governance Monitoring and Revision
- Technology advances — adoption of new technologies (e.g., cloud services) requires updated policies and procedures
- Regulatory changes — new or revised laws and standards require framework revisions to maintain compliance
- Cultural shifts — changes in industry practices (e.g., remote work) necessitate updated governance controls
Governance vs Compliance — Primary Distinction
Governance = the internal management framework the organization establishes to direct and control its IT activities. Compliance = adherence to external laws, regulations, and standards imposed by outside bodies. Scenario: 'organization sets internal policies and oversight structures' → governance. Scenario: 'organization must satisfy HIPAA or PCI-DSS requirements' → compliance.
Policy → Standard → Procedure Hierarchy
Policy (what, high-level commitment) → Standard (mandatory rules specifying how to satisfy the policy) → Procedure (step-by-step execution of the standard). Scenario: 'document states employees must protect sensitive data' → policy. Scenario: 'document mandates AES-256 for all stored PII' → standard. Scenario: 'document lists the steps to encrypt a file share' → procedure.
Guidelines vs Standards — Critical Distinction
Guidelines are NOT mandatory — they recommend approaches but compliance is optional. Standards ARE mandatory — they must be followed to satisfy a policy. Scenario: 'document recommends best practices but does not require them' → guideline. Scenario: 'document mandates specific encryption requirements' → standard.
Governance Monitoring vs Revision
Monitoring = identifying gaps and weaknesses in the current governance framework. Revision = updating the framework to address those gaps. Scenario: 'organization reviews its policies after regulations change' → monitoring. Scenario: 'organization updates its data protection policy to comply with a new law' → revision.
GRC — Governance Is the First Component
GRC order: Governance → Risk → Compliance. Governance sets the strategic framework; risk management operates within it; compliance verifies adherence to it. Scenario: 'which GRC component establishes the rules and oversight structures?' → governance.
Governance Structures (OBJ 5.1)
Board of Directors
Group of individuals elected by shareholders to oversee the management of an organization; responsible for setting strategic direction, establishing policies, and making significant decisions.
Committee (Governance)
Subgroup of a board of directors with a specific functional focus; allows for detailed attention to complex areas such as financial reporting, cybersecurity risk, or board effectiveness.
Government Entities (Governance Role)
Regulatory bodies that establish laws and regulations organizations must comply with; play a governance role particularly for public and regulated organizations (e.g., FTC enforces consumer protection and competition laws).
Centralized Governance Structure
Decision-making authority concentrated at the top levels of management; produces consistent policies and clear lines of authority but responds slowly to local or departmental needs.
Decentralized Governance Structure
Decision-making authority distributed throughout the organization; enables faster decisions and greater responsiveness to local needs but can produce inconsistent policy application across units.
Four Governance Structure Types
- Boards — elected by shareholders; set strategic direction and make significant organizational decisions
- Committees — board subgroups with specific focus areas (audit, governance, cybersecurity); provide detailed oversight of complex domains
- Government Entities — external regulatory bodies that impose compliance requirements on organizations
- Centralized vs Decentralized — internal structural choice determining where decision-making authority resides
Common Committee Types
- Audit Committee — oversees the organization's financial reporting process and internal controls
- Governance Committee — ensures the board operates effectively and adheres to governance principles
- Cybersecurity Committee — focuses on identifying and managing cybersecurity risks at the board level
Centralized vs Decentralized Trade-offs
- Centralized — consistent decision-making, clear authority, uniform policies; slower response to local or departmental needs
- Decentralized — faster decisions, greater agility and responsiveness; risk of inconsistent policies across business units
- Choice depends on organization size, goals, and need for uniformity vs agility
Centralized vs Decentralized — Scenario Mapping
Scenario: 'organization needs uniform security policies enforced consistently across all divisions' → centralized. Scenario: 'organization prioritizes speed and local autonomy over policy consistency' → decentralized. Key cue: consistency = centralized; agility/responsiveness = decentralized.
Board vs Committee — Scope Distinction
Board = full oversight body that sets overall strategic direction. Committee = specialized subgroup of the board focused on one domain (audit, cybersecurity, governance). Scenario: 'subgroup of the board reviews the organization's cybersecurity risk posture' → cybersecurity committee, not the full board.
Government Entities as External Governance Driver
Government entities (e.g., FTC, SEC) impose external compliance obligations — they are outside the organization's internal governance structure. Scenario: 'external body establishes regulations the organization's IT practices must satisfy' → government entity.
Policies (OBJ 5.1)
Acceptable Use Policy (AUP)
Document outlining the do's and don'ts for users interacting with an organization's IT systems and resources; sets boundaries for appropriate use to protect the organization from legal issues and security threats.
Information Security Policy
Defines how an organization protects its information assets from internal and external threats; covers data classification, access control, encryption, and physical security to maintain confidentiality, integrity, and availability.
Business Continuity Policy
Outlines how an organization will continue its critical operations during and after a disruption, with steps to ensure minimal service interruption and the fastest possible recovery.
Disaster Recovery Policy
Specifies how an organization will recover IT systems and data after a disaster; covers data backup and restoration, hardware and software recovery, and alternative processing locations.
Incident Response Policy
Plan for handling security incidents covering detection, reporting, assessment, response, and post-incident review; specifies who is notified, how the incident is contained and investigated, and how recurrence is prevented.
SDLC Policy (Software Development Lifecycle)
Guides software development through all stages from requirements gathering, design, and coding through testing, deployment, and maintenance; includes standards for secure coding practices and code reviews.
Change Management Policy
Governs how changes to IT systems and processes are handled in a controlled and coordinated manner; includes procedures for requesting, approving, implementing, and reviewing changes to minimize disruption risk.
Business Continuity vs Disaster Recovery
Business Continuity Policy focuses on maintaining critical operations during an ongoing disruption. Disaster Recovery Policy focuses specifically on recovering IT systems and data after a disaster has occurred. BC is broader in scope; DR is IT-system specific.
Incident Response Policy Components
- Detection — identifying that a security incident has occurred
- Reporting — notifying appropriate personnel and stakeholders
- Assessment — determining scope, severity, and impact of the incident
- Response — containing the threat and eradicating the cause
- Learning — post-incident review to identify lessons and prevent recurrence
Business Continuity vs Disaster Recovery — Primary Distinction
Scenario: 'policy ensuring the organization keeps operating during an active disruption' → Business Continuity Policy. Scenario: 'policy detailing how to restore IT systems and recover data after a disaster' → Disaster Recovery Policy. BC = operational continuity; DR = IT system restoration.
AUP — End-User Behavior Policy
Scenario: 'policy governing what employees may and may not do with company IT resources, including internet use and personal device rules' → AUP. AUP is the primary answer for controlling end-user behavior on organizational systems.
Change Management vs Incident Response
Change Management Policy = governs planned, controlled modifications to IT systems (proactive). Incident Response Policy = governs unplanned security events requiring rapid action (reactive). Scenario: 'deploying a new firewall rule' → change management. Scenario: 'responding to an active data breach' → incident response.
Standards (OBJ 5.1)
Password Standards
Mandatory requirements for credential complexity and management; typically include minimum length (8–12 characters), mixed character types, rotation intervals (every 60–90 days), prohibition of reuse, and enforcement of password hashing and salting.
Discretionary Access Control (DAC)
Access control model where the owner of a resource determines who can access it; provides flexible, owner-driven access decisions.
Mandatory Access Control (MAC)
Access control model using labels or security classifications to determine access rights; access decisions are enforced by the system, not resource owners. Commonly used in government and military settings.
Role-Based Access Control (RBAC)
Access control model assigning access rights based on a user's role within the organization; ensures users access only what is required for their job functions, directly supporting least privilege.
Least Privilege
Security principle ensuring users have only the minimum level of access required to perform their duties; limits the impact of compromised accounts and insider threats.
Separation of Duties
Security principle preventing any single individual from having complete control over a critical process or system; reduces insider threat and fraud risk by requiring multiple parties for high-impact actions.
Access Control Models Comparison
- DAC — resource owner decides who has access; flexible; common in general business environments
- MAC — system enforces access via security labels/classifications; rigid; used in government and military
- RBAC — access assigned by job role; balances flexibility and control; most common in enterprise environments
Physical Security Standard Components
- Perimeter security — fences, gates, and security guards
- Surveillance — CCTV systems covering access points and sensitive areas
- Access control mechanisms — biometric scanners, keycards, and PIN pads
- Environmental controls — fire suppression systems, HVAC controls, and power redundancy
- Secure areas — server rooms and data centers with additional access restrictions and surveillance
Encryption Standard Use Cases
- AES (Advanced Encryption Standard) — symmetric; used for data at rest due to strong security and efficient performance
- RSA — asymmetric; used for secure communication and key exchange via public key infrastructure
- Use case rule: data at rest → AES; secure communication and key exchange → RSA
DAC vs MAC vs RBAC — Scenario Mapping
Scenario: 'file owner grants a colleague access to a document' → DAC. Scenario: 'access determined by security clearance level stamped on files' → MAC. Scenario: 'employees receive system access based on their job title or department' → RBAC. MAC is most restrictive; DAC is most flexible.
Least Privilege vs Separation of Duties
Least Privilege = each user gets only the minimum access their role requires. Separation of Duties = no single user can complete a high-risk process alone. Scenario: 'preventing one administrator from both approving and executing a financial transfer' → separation of duties.
AES vs RSA — Use Case Distinction
Scenario: 'encrypt a database of customer PII stored on disk' → AES (symmetric, data at rest). Scenario: 'encrypt a session key during a TLS handshake' → RSA (asymmetric, key exchange). AES = bulk data / at rest; RSA = key exchange / secure communication.
Procedures (OBJ 5.1)
Playbook
Predefined checklist of actions to detect and respond to a specific type of security incident; provides step-by-step guidance ensuring consistent and rapid response regardless of who executes it.
Onboarding
Process of integrating new employees into an organization; includes orientation, role-specific training, and provisioning of credentials and system access. Goal: productive and engaged employees as quickly as possible.
Offboarding
Process of managing an employee's departure; includes retrieving company property, disabling all system access, and conducting exit interviews. Goal: smooth transition and elimination of residual access risk.
Change Management Procedure Stages
- Identify — recognize the need for change and assess potential impacts on related systems
- Plan — develop a detailed plan specifying how the change is implemented, who is involved, and what resources are required
- Implement — execute the change, often in stages, to surface issues incrementally
- Review — assess the outcome, capture lessons learned, and document the full process
Change Management Best Practices
- Rollback plan — every change must include a defined revert procedure if results are negative or unexpected
- Test first — significant changes should be tested in a non-production environment before deployment
- Maintenance window — disruptive changes should be scheduled during designated low-impact periods
- Documentation — the complete change process must be recorded for audit and future reference
Onboarding vs Offboarding Security Tasks
- Onboarding: security awareness training, provisioning credentials, granting appropriate system access
- Offboarding: immediately disabling all system access, revoking credentials, recovering company property, conducting exit interview
Playbook vs Policy vs Procedure
Policy = high-level intent (what must be done). Procedure = step-by-step instructions for a general task. Playbook = step-by-step response guide for a specific incident type. Scenario: 'step-by-step guide for responding to a ransomware attack' → playbook. Scenario: 'document governing how all security incidents are handled' → incident response policy.
Offboarding — Critical Security Step
Disabling system access is the most security-critical offboarding step. Scenario: 'former employee retains active credentials after departure' → offboarding failure. Primary control: immediate revocation of all access rights and credentials at the time of departure.
Change Management — Rollback Requirement
Every change must include a rollback plan. Scenario: 'a firewall rule update causes unexpected service outages' → execute rollback plan. Scenario: 'team tests a patch in staging before production deployment' → change management best practice (test first, maintenance window).
Governance Considerations (OBJ 5.1)
GDPR (General Data Protection Regulation)
European Union regulation governing how organizations collect, store, and use personal data of EU citizens; applies globally — any organization processing EU citizen data must comply regardless of where the organization is based.
CCPA (California Consumer Privacy Act)
California state regulation granting residents the right to know what personal data is collected about them, the right to delete it, and the right to opt out of the sale of their personal data.
ADA (Americans with Disabilities Act)
US federal law requiring businesses to provide reasonable accommodations for employees with disabilities and ensure accessibility for customers with disabilities.
Conflict of Laws
Situation where regulations differ across jurisdictions, requiring organizations operating globally to navigate and reconcile competing legal requirements (e.g., differing data protection laws across countries).
Four Governance Consideration Categories
- Regulatory — industry-specific regulations from oversight bodies; non-compliance risks fines, sanctions, and reputational damage (e.g., GDPR for data privacy, PCI-DSS for payment cards)
- Legal — contract law, intellectual property, employment law, and corporate law; primary risk is litigation from breach of contract, product liability, or employment disputes
- Industry — technical standards and best practices prevalent in a sector; often not legally binding but shape customer, partner, and regulator expectations
- Geographical — local, regional, national, and global regulations that vary by jurisdiction and may conflict with one another
Geographical Consideration Scope Examples
- Local — city zoning ordinances limiting business operations in certain areas
- Regional — CCPA (California) granting state residents rights over their personal data
- National — ADA (US) requiring disability accommodations across all businesses
- Global — GDPR (EU) applying to any organization worldwide that processes EU citizens' data
GDPR — Global Reach
GDPR applies to ANY organization processing EU citizens' data regardless of where that organization is based. Scenario: 'company headquartered in the US collects email addresses from EU website visitors' → GDPR applies. GDPR is simultaneously a regulatory and a global governance consideration.
Regulatory vs Legal Considerations
Regulatory = compliance with government-imposed industry rules (e.g., HIPAA, PCI-DSS); non-compliance → fines and sanctions. Legal = compliance with contract law, employment law, IP law; non-compliance → litigation. Both categories require distinct governance responses.
Governance Scope — Jurisdiction Mapping
Scenario: 'state law granting data deletion rights to residents' → regional (CCPA). Scenario: 'federal law mandating disability accommodations' → national (ADA). Scenario: 'EU regulation that a non-EU company must follow' → global (GDPR).
Compliance (OBJ 5.4)
Compliance Reporting
Systematic process of collecting and presenting data to demonstrate adherence to compliance requirements; categorized as internal (for the organization itself) or external (for regulatory bodies, auditors, or customers).
Internal Compliance Reporting
Collection and analysis of data to verify adherence to an organization's own policies and procedures; conducted by an internal audit team or compliance department.
External Compliance Reporting
Demonstrating compliance to outside entities such as regulatory bodies, auditors, or customers; often mandated by law or contract (e.g., regulated industries submit reports to oversight bodies on required practices).
Compliance Monitoring
Process of regularly reviewing and analyzing an organization's operations to ensure ongoing compliance with laws, regulations, and internal policies; includes due diligence, due care, attestation, and internal and external audits.
Acknowledgement (Compliance)
Recognition and acceptance of compliance requirements by all relevant parties; confirms awareness of obligations. Distinct from attestation, which is a formal declaration that controls ARE compliant.
Four Compliance Imperatives
- Legal Obligations — non-compliance can lead to fines and sanctions
- Trust and Reputation — compliance with industry standards builds stakeholder confidence and enhances organizational reputation
- Data Protection — compliance with data protection regulations prevents breaches and protects customer and employee privacy
- Business Continuity — compliance with DR/BC standards ensures the organization can continue operations after a disruption
Internal vs External Compliance Reporting
- Internal — verifies adherence to the organization's own policies; conducted by internal audit or compliance teams; audience is internal management
- External — demonstrates compliance to outside parties (regulators, auditors, customers); often legally or contractually mandated; carries higher assurance weight
Compliance Monitoring Components
- Due Diligence — exhaustive pre-action review to identify potential compliance risks before acting
- Due Care — steps taken to mitigate identified risks (implementing controls, training staff, hiring specialists)
- Attestation — formal declaration by a responsible party that processes and controls are compliant
- Acknowledgement — recognition and acceptance of compliance requirements by all relevant parties
- Internal Monitoring — regular internal reviews to confirm adherence to policies and procedures
- External Monitoring — independent third-party audits to verify compliance with external regulations or standards
Role of Automation in Compliance
Automated compliance systems streamline data collection, improve accuracy, and provide real-time monitoring without manual review cycles; used to automatically flag policy violations (e.g., unauthorized access to protected health records) and generate audit-ready reports.
Attestation vs Acknowledgement — Primary Distinction
Attestation = formal declaration that controls ARE compliant (active assertion by a responsible party). Acknowledgement = confirmation that compliance requirements have been read and understood (awareness, not a compliance assertion). Scenario: 'developer formally declares their code meets all data security requirements' → attestation. Scenario: 'employee signs a receipt confirming they read the AUP' → acknowledgement.
Internal vs External Compliance Monitoring
Scenario: 'organization's own audit team reviews production processes against internal quality standards' → internal monitoring. Scenario: 'independent third-party auditor certifies the organization meets ISO 27001' → external monitoring. External monitoring carries higher assurance weight with regulators and business partners.
Due Diligence vs Due Care in Compliance Context
Scenario: 'company researches a foreign country's regulations before expanding operations there' → due diligence. Scenario: 'company trains employees and implements required controls to comply with those regulations' → due care. Diligence = investigating what must be done; Care = doing it.
Non-Compliance Consequences (OBJ 5.4)
Fines (Non-Compliance)
Monetary penalties imposed by regulatory bodies for violations; GDPR fines reach up to €20 million or 4% of annual global turnover, whichever is higher. The 2019 British Airways GDPR fine of £183 million (breach affecting 500,000 customers) illustrates the scale.
Sanctions (Non-Compliance)
Restrictive enforcement measures beyond financial penalties; can range from formal warnings and operational restrictions to outright bans on conducting specific business activities.
Reputational Damage (Non-Compliance)
Negative impact on an organization's public standing following a compliance failure or breach; manifests as customer loss, declining stock price, and long-lasting erosion of stakeholder trust. The 2017 Equifax breach (147 million people affected, 30%+ stock decline) is a documented example.
Loss of License (Non-Compliance)
Revocation of an organization's authorization to operate in a regulated industry or jurisdiction due to failure to meet required standards; can result in a complete halt to operations in that area.
Contractual Impacts (Non-Compliance)
Compliance failures that place an organization in breach of contract with clients or partners; consequences include legal disputes, financial penalties, and termination of contracts.
Five Non-Compliance Consequences
- Fines — monetary penalties from regulators (GDPR: up to €20M or 4% of annual global turnover, whichever is higher)
- Sanctions — operational restrictions or bans enforced by regulatory bodies beyond financial penalties
- Reputational Damage — loss of customer trust, negative media coverage, and declining stock value
- Loss of License — revocation of the right to operate in a regulated industry or jurisdiction
- Contractual Impacts — breach of contract with clients or partners triggering legal disputes or termination
GDPR Fine Structure — Know the Numbers
GDPR maximum fine: €20 million OR 4% of annual global turnover — whichever is HIGHER. Scenario: 'large enterprise suffers a serious breach involving EU citizen data' → fine up to 4% of global turnover. The 'whichever is higher' clause makes fines proportionally larger for major corporations.
Non-Compliance Consequence Scenario Mapping
Scenario: 'regulator issues a financial penalty for a HIPAA violation' → fine. Scenario: 'regulator prohibits a firm from accepting new clients pending remediation' → sanction. Scenario: 'payment brand revokes processing rights after a PCI-DSS failure' → loss of license. Scenario: 'client terminates contract after a breach notification deadline is missed' → contractual impact.
Reputational Damage — Distinct from Financial Penalties
Reputational damage is a non-financial consequence that can outlast fines; it manifests as customer attrition, partner loss, stock price decline, and difficulty attracting talent. Scenario: 'a publicly reported breach causes mass customer cancellations and media coverage' → reputational damage, not a fine or sanction.