Compliance
Compliance Is Not Security. Both Matter.
In 2019, British Airways was fined £20 million by the UK Information Commissioner's Office. Attackers had compromised the airline's website and redirected customers to a fraudulent site that harvested payment card details. Around 500,000 customers were affected. The breach ran for two months before detection.
British Airways was PCI-DSS compliant at the time.
The fine was issued under GDPR. The breach violated the regulation's requirement to implement appropriate technical and organizational measures to protect personal data. Compliance with one framework did not prevent violation of another. And compliance with all applicable frameworks did not prevent the breach.[1]
This is the central tension in compliance: organizations often treat it as a destination rather than a baseline. Pass the audit. Tick the box. Move on. But compliance frameworks define the floor of acceptable security practice, not the ceiling. An organization can be fully compliant and still be breached. Security is what compliance is supposed to reflect — but the reflection is imperfect.
Understanding compliance means understanding what it actually requires, what it does not require, and how to navigate a landscape where the requirements multiply every year.
What Compliance Actually Is
Compliance is the state of adhering to laws, regulations, contractual obligations, or standards that apply to an organization. In information security, those requirements typically mandate:
Specific technical controls (encryption, access management, logging)
Administrative processes (policies, training, risk assessments, incident response plans)
Physical safeguards (access controls on data centers, equipment disposal)
Audit and accountability mechanisms (documentation, evidence collection, third-party audits)
Compliance is not optional when it is legally required. GDPR fines reach 4% of global annual revenue. HIPAA violations carry criminal penalties. PCI-DSS non-compliance can result in losing the ability to process credit cards. These are business-critical consequences.
The compliance vs. security distinction matters:
Compliance asks: "Does this control exist and is it documented?"
Security asks: "Does this control actually reduce risk?"
A firewall that exists but is misconfigured satisfies a compliance checkbox. It does not provide security. The goal is to implement controls that are both compliant and effective — but the two are not automatic synonyms. Organizations that treat compliance as a proxy for security, rather than as a starting point, make themselves vulnerable.
The Major Compliance Frameworks
GDPR (General Data Protection Regulation)
Who it applies to: Any organization, anywhere in the world, that processes personal data of individuals in the European Union or European Economic Area.
GDPR is the most expansive data protection regulation in force. It applies to a startup in Singapore if that startup collects email addresses from EU residents. It applies to a US SaaS company if EU businesses use its product to process customer data.[2]
Key requirements:
Lawful basis: Processing personal data requires a documented lawful basis (consent, contract, legal obligation, legitimate interests, etc.)
Data minimization: Collect only what is necessary for the stated purpose
Breach notification: Report breaches to the supervisory authority within 72 hours of becoming aware; notify affected individuals without undue delay when high risk
Data subject rights: Respond to requests for access, deletion, correction, and portability
Data Protection Officer (DPO): Required for public authorities, organizations processing data at scale, or those processing sensitive categories of data
Appropriate technical and organizational measures: No specific controls mandated; must be proportionate to the risk
Penalties: Up to €20 million or 4% of global annual revenue, whichever is higher. In 2023, Meta was fined €1.2 billion for transferring EU user data to the US without adequate safeguards.[3]
Cross-border data transfers are a moving target. That €1.2 billion Meta fine was about where data went, not how it was secured. The legal basis for moving EU personal data to the US has been repeatedly struck down: the Court of Justice of the EU invalidated Safe Harbor in 2015 and Privacy Shield in 2020 (the "Schrems II" decision). The current mechanism, the EU-US Data Privacy Framework adopted in 2023, faces ongoing legal challenges, and Standard Contractual Clauses now require a documented transfer impact assessment. For any organization moving personal data across the Atlantic, "is our transfer mechanism still valid?" is a question with no permanent answer — track it actively.
HIPAA (Health Insurance Portability and Accountability Act)
Who it applies to: US healthcare providers, health plans, healthcare clearinghouses (covered entities), and their business associates (vendors who process protected health information on their behalf).
HIPAA mandates specific controls for electronic protected health information (ePHI) through three rules:[4]
Privacy Rule
Permitted uses and disclosures of PHI; patient rights over their information
Security Rule
Administrative, physical, and technical safeguards for ePHI
Breach Notification Rule
Requirements to notify individuals, HHS, and media when ePHI is breached
Key technical safeguards: Access controls (unique user identification, emergency access procedures), audit controls, integrity controls, transmission security (encryption for data in transit).
Penalties: Tiered from $100 to $50,000 per violation, up to $1.9 million per violation category per year. Criminal penalties apply for intentional violations.
PCI-DSS (Payment Card Industry Data Security Standard)
Who it applies to: Any organization that stores, processes, or transmits payment card data — merchants, payment processors, service providers, and their vendors.
PCI-DSS is maintained by the Payment Card Industry Security Standards Council (a consortium of Visa, Mastercard, American Express, Discover, and JCB) and is contractually required by card network agreements rather than law.[5]
The current version is PCI DSS v4.0.1 (a June 2024 clarifying revision of v4.0). A timeline point that matters in practice: the standard's "future-dated" requirements — 51 of the new controls introduced in v4.0 — were best-practice recommendations until March 31, 2025, after which they became mandatory. As of 2026 there is no grace period left; an assessment now tests against the full v4.0.1 requirement set. You may still encounter legacy systems built to the older v3.2.1, but they are out of compliance.
The 12 requirements (PCI DSS v4.0.1):
Network security
Build and maintain a secure network; install firewalls; change vendor default passwords
Cardholder data
Protect stored cardholder data; encrypt transmission over public networks
Vulnerability management
Use anti-malware; maintain secure systems and software
Access control
Restrict access to cardholder data; authenticate access; restrict physical access
Monitoring
Log and monitor access; test security systems regularly
Policy
Maintain an information security policy
Non-compliance consequences: fines from card networks ($5,000 to $100,000/month), increased transaction fees, and ultimately loss of the ability to accept card payments.
SOC 2 (System and Organization Controls 2)
Who it applies to: Technology and cloud service providers that store or process customer data. SOC 2 is not a regulation but a voluntary attestation widely required as a condition of doing business.
SOC 2 audits are conducted by licensed CPA firms against the AICPA Trust Services Criteria, which cover five categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Organizations select which categories apply to their services.[6]
SOC 2 Type I
Controls are designed appropriately (a point-in-time assessment)
SOC 2 Type II
Controls operated effectively over a defined period (typically 6-12 months)
Type II reports are the meaningful standard. A Type I report only proves that controls exist on paper on a specific day. A Type II report proves they actually operated consistently.
SOC 2 is the de facto standard for SaaS companies selling to enterprise customers. Enterprise procurement teams require it before approving vendors who will process their data.
Open-source SOC 2 / ISO 27001 compliance starter: comply by StrongDM is a free, open-source compliance-as-code kit that includes policy documents, control definitions, and evidence-gathering templates structured for SOC 2 and ISO 27001. A practical working starting point, not just documentation.
ISO/IEC 27001
Who it applies to: Any organization, any size, any sector. ISO 27001 is the international standard for information security management systems (ISMS).
Unlike most compliance frameworks, ISO 27001 does not mandate a specific list of controls. It mandates a management system: a risk-based, continuously improving cycle of planning, implementing, monitoring, and improving information security.[7] Organizations assess their risks and select controls from Annex A (93 controls across 11 domains in the 2022 edition) proportionate to those risks.
Certification is awarded by accredited certification bodies after a two-stage audit: a documentation review and an on-site assessment. Certification must be maintained through annual surveillance audits and a full recertification every three years.
Why it matters: ISO 27001 certification is increasingly required in European government and enterprise procurement, and is a credible signal of security maturity globally.
Free ISO 27001 templates: The ISO27k Toolkit provides a community-maintained collection including a pre-built Statement of Applicability, risk treatment plan, management review minutes, and internal audit checklist — the core documentation set for ISO 27001 certification, free and ready to adapt.
CMMC (Cybersecurity Maturity Model Certification)
Who it applies to: US Department of Defense contractors and subcontractors handling Controlled Unclassified Information (CUI).
CMMC 2.0 establishes three maturity levels, with Level 2 requiring an independent third-party assessment against NIST SP 800-171's 110 security requirements. CMMC is no longer a future possibility — the final acquisition rule (48 CFR) took effect on November 10, 2025, beginning a phased rollout that incorporates CMMC clauses into new DoD contracts and option years. Contractors without the CMMC level required by a given contract are ineligible to win it. If you're entering GRC in the defense industrial base, this is now live, not pending.[8]
FedRAMP (Federal Risk and Authorization Management Program)
Who it applies to: Cloud service providers seeking to sell to US federal agencies.
FedRAMP standardizes cloud security assessment, authorization, and monitoring for federal systems. It is based on NIST SP 800-53 controls, with three impact levels (Low, Moderate, High) determining which control set applies. Authorization requires a significant investment: third-party assessment organization (3PAO) audit, agency sponsorship, and ongoing continuous monitoring.[9]
The Frameworks at a Glance
It's easy to lose the forest for the trees. This matrix is the one-screen summary of who each framework applies to and how it's verified.
GDPR
Anyone processing EU residents' personal data
Law (EU regulation)
No certification — ongoing obligation enforced by regulators
HIPAA
US healthcare entities and their business associates
Law (US federal)
No certification — enforced by HHS; risk assessment evidence expected
PCI DSS
Anyone handling payment card data
Contractual (card networks)
Self-Assessment Questionnaire or external Report on Compliance, by volume
SOC 2
Cloud/SaaS service providers
Voluntary (market-driven)
Independent CPA audit; Type II report over a period
ISO 27001
Any organization, any sector
Voluntary (often contract-required)
Accredited certification body audit; 3-year cycle
CMMC
US DoD contractors handling CUI
Contractual (now in DFARS)
Self-assessment (L1) or third-party assessment (L2+)
FedRAMP
Cloud providers selling to US federal agencies
Required to sell to gov
3PAO audit + agency authorization + continuous monitoring
The pattern worth internalizing: regulations (GDPR, HIPAA) are obligations you can be punished for breaking but can't get a certificate for, while standards (ISO 27001, SOC 2, CMMC, FedRAMP) are things you get formally assessed and credentialed against. The controls underneath them overlap heavily — which is the whole point of the multi-framework section below.
The Compliance Lifecycle
Compliance is not a project with a completion date. It is an ongoing cycle.
Assess: Determine which regulations and frameworks apply. Conduct a gap assessment against each applicable standard to understand current state vs. required state.
Plan: Develop a remediation roadmap. Prioritize gaps by risk and compliance deadline. Assign ownership and timelines.
Implement: Deploy the required controls — technical, administrative, and physical. Document everything. Evidence is the currency of compliance.
Audit: Internal auditors verify controls are implemented and operating. Findings are documented and remediated. For certifiable standards (ISO 27001, SOC 2, CMMC), external auditors conduct formal assessments.
Certify: Formal certification or attestation is issued. For regulations like GDPR and HIPAA, there is no certification — compliance is an ongoing obligation enforced by regulators.
Monitor: Compliance does not hold itself. Controls drift. Regulations change. New systems are deployed that are not in scope. Continuous monitoring — including automated compliance tools, regular internal audits, and management reviews — maintains the certified state.
The gap between certification and compliance: ISO 27001 certification is valid for three years with annual surveillance audits. A system deployed the day after a certification audit has three years of potential drift before the next full audit. Organizations that treat certification as a finish line rather than a waypoint accumulate compliance debt that surfaces dramatically during the next audit or, worse, during a breach investigation.
Evidence Management
Compliance lives and dies on documentation. Every control must be evidenced — not just stated to exist, but demonstrated to be operating.
Evidence types include:
Policies and procedures: Written documents defining what must happen
Configuration screenshots: System settings showing controls are enabled
Log exports: Records of activity demonstrating controls operated
Training completion records: Evidence that staff received required training
Risk assessment documents: Documented evidence of the risk assessment process
Vendor assessments: Evidence of third-party security evaluation
Penetration test reports: Evidence of technical security testing
Audit reports: Results of internal and external audits with findings and remediation
Evidence must be:
Current (not from three years ago)
Complete (covering the full scope, not selected systems)
Authentic (not modified)
Accessible (retrievable when auditors request it)
GRC platforms — Vanta, Drata, Secureframe, OneTrust, ServiceNow GRC — automate evidence collection by integrating with cloud platforms, identity providers, and security tools to pull compliance evidence continuously rather than in manual point-in-time snapshots. (The category has consolidated; older tools like Tugboat Logic were absorbed into larger vendors, so always check what's current when evaluating.) "Current" evidence increasingly means real-time or daily automated snapshots, not a folder of screenshots assembled the week before an audit.
Multi-Framework Compliance
Most organizations are subject to multiple frameworks simultaneously. A US healthcare SaaS company might need HIPAA, SOC 2, ISO 27001, and GDPR at the same time.
The practical approach is to map frameworks against each other to identify overlap. Most frameworks share common control objectives:
Controls that satisfy multiple frameworks simultaneously:
MFA on all accounts: satisfies GDPR Article 32, HIPAA technical safeguards, PCI-DSS Req 8, ISO 27001 A.9, SOC 2 CC6.1
Encryption in transit and at rest: satisfies GDPR, HIPAA, PCI-DSS, ISO 27001, SOC 2
Access reviews (quarterly): satisfies HIPAA, PCI-DSS, ISO 27001, SOC 2
Security awareness training: satisfies HIPAA, PCI-DSS, ISO 27001, SOC 2, CMMC
Implementing controls correctly once and mapping them to all applicable frameworks is far more efficient than implementing separate control sets per framework. This is the foundation of an integrated compliance program.
Third-Party and Supply Chain Compliance
An organization's compliance obligations extend to vendors and suppliers that handle their regulated data. GDPR requires Data Processing Agreements with all processors of EU personal data. HIPAA requires Business Associate Agreements with all parties handling PHI. PCI-DSS requires ensuring that third-party service providers also comply with applicable requirements.
Third-party compliance management involves:
Maintaining a vendor inventory (who has access to what data)
Executing required legal agreements (DPAs, BAAs)
Assessing vendor compliance posture (questionnaires, certifications, right-to-audit)
Monitoring vendor compliance on an ongoing basis
Defining processes for vendor incidents (what happens when a vendor is breached)
The 2023 MOVEit breach, in which the Cl0p ransomware group exploited a SQL injection zero-day, illustrates the supply chain compliance challenge: hundreds of organizations discovered they were indirectly affected because their vendors used MOVEit Transfer for file sharing. The downstream data exposure triggered GDPR, HIPAA, and state breach notification obligations for organizations that had no direct relationship with MOVEit.[10]
Compliance as a Career
Compliance and GRC roles are among the most stable and well-compensated non-technical positions in cybersecurity. Organizations subject to multiple frameworks need dedicated compliance professionals who understand both the regulatory landscape and the technical controls that satisfy it.
Common roles:
Compliance Analyst: managing evidence collection, audit preparation, policy maintenance
GRC Manager: overseeing multiple frameworks, managing assessments, reporting to leadership
Data Protection Officer (DPO): legally mandated role under GDPR for certain organizations
Virtual CISO (vCISO): fractional senior security and compliance leadership across multiple clients
Audit Manager: leading internal or external compliance audits
Skills that matter:
Deep knowledge of 2-3 primary frameworks relevant to your industry
Familiarity with GRC platforms (Vanta, Drata, OneTrust, ServiceNow)
Evidence management and audit preparation experience
Clear written communication for policy development and executive reporting
Ability to translate regulatory requirements into technical control specifications
Templates and Examples You Can Use Today
Compliance requires documentation. These free resources give you a starting point for every major framework covered in this chapter — no registration or purchase required for the most useful ones.
ISO 27001, SOC 2, HIPAA, PCI-DSS
27 ready-to-customize policies that map to ISO 27001 Annex A and SOC 2 Common Criteria
ISO 27001
Free Statement of Applicability, risk treatment plan, management review minutes, and internal audit checklist
SOC 2, ISO 27001
Open-source compliance-as-code kit: policy documents, control definitions, and evidence templates
SOC 2
Free authoritative SOC 2 control list (registration required, no charge)
FedRAMP, NIST 800-53
Write controls once in structured YAML; generate compliance documentation for multiple frameworks
FedRAMP, CMMC, ISO 27001
Free comprehensive control catalog behind FedRAMP; includes cross-walks to ISO 27001 Annex A
PCI-DSS, SOC 2, ISO 27001
Free hardening checklists accepted as PCI-DSS and SOC 2 audit evidence; covers every major OS and platform
PCI-DSS
Free PCI-DSS v4.0 standard, Self-Assessment Questionnaires (SAQs), and Report on Compliance templates
HIPAA
Free Windows/Mac app from HHS that guides a HIPAA Security Rule risk assessment with built-in report output
GDPR
Free DPIA, Records of Processing Activities (ROPA), and breach notification templates
Which to start with depends on your priority framework:
Preparing for ISO 27001? Start with SANS policies and the ISO27k Toolkit.
SOC 2 readiness? Start with SANS policies and the comply (StrongDM) GitHub repo.
HIPAA compliance? Start with the HHS Risk Assessment Tool and SANS healthcare-specific templates.
PCI-DSS? Download the appropriate SAQ from the PCI SSC Document Library first to scope your obligations before building any controls.
Try This
Map one control across frameworks. Take a single control you understand — multi-factor authentication is ideal — and find where it appears in three different frameworks (e.g. PCI DSS Req 8, ISO 27001 Annex A, SOC 2 CC6.1). Write the requirement number and the exact wording from each. You've just done the core motion of integrated compliance: implement once, satisfy many. This is also a great interview talking point.
Scope a real obligation. Pick a fictional small business (a healthcare app, an EU-facing SaaS, an online shop) and list every framework it's subject to and why. Then download the relevant starter doc — the HHS HIPAA Risk Assessment Tool, a PCI SAQ, or the GDPR.eu checklist — and complete the first section. Scoping obligations correctly is the single most valuable thing a junior GRC analyst does.
Key Takeaways
Compliance is the floor, not the ceiling. British Airways was PCI compliant and still breached and fined — a control that exists on paper isn't a control that reduces risk.
Distinguish regulations you're punished for breaking (GDPR, HIPAA) from standards you're certified against (ISO 27001, SOC 2, CMMC, FedRAMP). The verification model differs fundamentally.
Know the 2025–2026 status: PCI DSS v4.0.1 future-dated requirements are now mandatory, CMMC is live in DoD contracts, and EU-US data transfer mechanisms remain legally contested.
Compliance is a continuous lifecycle, and evidence is its currency — increasingly automated and continuous, not assembled the week before an audit.
Most organizations face several frameworks at once. Implement overlapping controls once (MFA, encryption, access reviews, training) and map them to every applicable framework.
References
[1] Information Commissioner's Office. (2020). ICO fines British Airways £20 million for data breach affecting more than 400,000 customers. ICO. Retrieved from https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2020/10/ico-fines-british-airways-20million-for-data-breach-affecting-more-than-400-000-customers/
[2] European Parliament and Council of the European Union. (2016). Regulation (EU) 2016/679 -- General Data Protection Regulation. Official Journal of the European Union, L 119, 1-88. Retrieved from https://gdpr-info.eu
[3] Data Protection Commission Ireland. (2023). Decision of the Data Protection Commission: Meta Platforms Ireland Limited. DPC. Retrieved from https://www.dataprotection.ie/en/dpc-guidance/decision-meta-platforms-ireland-limited
[4] US Department of Health and Human Services. (2003). Security Standards for the Protection of Electronic Protected Health Information. Federal Register, 68(34), 8333-8381. Retrieved from https://www.hhs.gov/hipaa/for-professionals/security/index.html
[5] PCI Security Standards Council. (2022). Payment Card Industry Data Security Standard Requirements and Testing Procedures, Version 4.0. PCI SSC. Retrieved from https://www.pcisecuritystandards.org
[6] American Institute of CPAs. (2017). Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (SOC 2). AICPA. Retrieved from https://www.aicpa.org/resources/download/2017-trust-services-criteria-for-security-availability-processing-integrity-confidentiality-and-privacy
[7] International Organization for Standardization. (2022). ISO/IEC 27001:2022 -- Information Security Management Systems -- Requirements. ISO/IEC JTC 1/SC 27.
[8] US Department of Defense. (2021). Cybersecurity Maturity Model Certification (CMMC) 2.0. Office of the Under Secretary of Defense for Acquisition and Sustainment. Retrieved from https://www.acq.osd.mil/cmmc/
[9] General Services Administration. (2023). FedRAMP Authorization Act Implementation Guidance. Federal Risk and Authorization Management Program. Retrieved from https://www.fedramp.gov
[10] Cybersecurity and Infrastructure Security Agency. (2023). #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability. CISA Advisory AA23-158A. Retrieved from https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
Further Reading
Clean, searchable GDPR with articles and recitals. Essential reference for data protection work.
Official source for HIPAA rules, guidance, and enforcement actions.
Current PCI-DSS standard and supporting guidance documents.
The international ISMS certification standard.
US federal cloud authorization program documentation and approved provider list.
Questions about compliance frameworks, GRC career paths, or audit preparation? Join the community on Discord or reach out on LinkedIn. If this chapter helped, contribute back. This book is open source and your additions are welcome.
Last updated