CompTIA Security+ Preparation · lesson 38 of 45 · 25 min
Compliance and Regulations
Compliance means adhering to laws, regulations, standards, and contractual obligations that apply to an organization. Non-compliance can result in fines, legal liability, loss of business, and reputational damage.
Security professionals must understand which regulations apply to their industry and what controls are required. The Security+ exam tests key regulations and their requirements.
Key Regulations
Data Classification
Privacy Concepts
Flashcard Drill
GDPR EU regulation protecting personal data of EU residents — 72-hour breach notification; right to erasure. HIPAA US healthcare regulation protecting ePHI — administrative, physical, and technical safeguards required. PCI-DSS 12-requirement standard for protecting payment card data — mandatory for card processors. PII Personally Identifiable Information — any data that can identify an individual. PHI Protected Health Information — health data linked to an individual; protected by HIPAA. Data minimization Collect only the data necessary for the stated purpose — a GDPR principle. Right to be forgotten GDPR right allowing individuals to request deletion of their personal data. Privacy by design Building privacy protections into systems from the start, not added later. SOX Sarbanes-Oxley — US law requiring financial reporting controls and IT audit trails for public companies. Data retention policy Defines how long data is kept and when it must be deleted — must align with legal requirements.
Scenario Practice
GDPR Breach Notification
Within 30 days of discovery. Within 72 hours of becoming aware of the breach. Only if customers complain. Within 1 year — GDPR only applies to large companies. 1 GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a breach involving personal data of EU residents. GDPR applies to any organization processing EU residents’ data, regardless of company size or location.
Knowledge Check
Compliance — 10 Questions
Which regulation requires breach notification to supervisory authorities within 72 hours?
- HIPAA
- PCI-DSS
- GDPR
- SOX
Answer: GDPR
GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.
HIPAA protects which type of data?
- Payment card data
- Student education records
- Electronic Protected Health Information (ePHI)
- Financial reporting data
Answer: Electronic Protected Health Information (ePHI)
HIPAA’s Security Rule protects ePHI — electronic health information linked to an individual.
PCI-DSS applies only to banks and credit card companies.
- True
- False
Answer: False
PCI-DSS applies to ANY organization that processes, stores, or transmits payment card data — retailers, restaurants, e-commerce sites, etc.
Any data that can identify an individual — such as name, SSN, or email address — is called _____.
Answer: PII
PII (Personally Identifiable Information) is any data that can identify a specific individual.
The GDPR principle of collecting only the data necessary for the stated purpose is called:
- Data retention
- Data minimization
- Privacy by design
- Right to erasure
- Answer: Data minimization
Data minimization requires organizations to collect only the minimum personal data necessary for their stated purpose. SOX (Sarbanes-Oxley) primarily applies to:
- Healthcare organizations
- US publicly traded companies
- Payment card processors
- Educational institutions
- Answer: US publicly traded companies
SOX requires US public companies to maintain accurate financial records and implement IT controls supporting financial reporting.
Which are GDPR data subject rights? (Select all that apply)
- Right to access
- Right to erasure
- Right to unlimited data collection
- Right to data portability
- Right to object
Answer: Right to access
Right to erasure
- Right to data portability
- Right to object
GDPR grants rights to access, rectification, erasure, portability, and objection. There is no right to unlimited data collection. Privacy by design means:
- Adding privacy controls after a system is built
- Building privacy protections into systems from the start
- Encrypting all data at rest
- Hiring a Data Protection Officer
- Answer: Building privacy protections into systems from the start
Privacy by design integrates privacy into system architecture from the beginning — not as an afterthought.
FERPA protects the privacy of student education records at institutions receiving US federal funding.
- True
- False
Answer: True
FERPA (Family Educational Rights and Privacy Act) protects student education records at federally funded schools.
Which California privacy law gives residents rights similar to GDPR — including the right to know, delete, and opt out of data sale?
- HIPAA
- GLBA
- CCPA
- SOX
Answer: CCPA
The California Consumer Privacy Act (CCPA) gives California residents rights over their personal data — similar to GDPR.
Previous lesson: Vulnerability scanning tools: Nessus, OpenVAS, Qualys — interpreting scan results
Back to CompTIA Security+ Preparation
Next lesson: Compliance and regulations: GDPR, HIPAA, PCI-DSS, SOX