Compliance

Regulatory Frameworks and Compliance Fundamentals

Compliance is the state of meeting the requirements set by laws, regulations, policies, and contractual obligations. Organizations operate in an environment where compliance failures carry real consequences: financial penalties, criminal prosecution, loss of operating licenses, and termination of business relationships.

What Compliance Means

Compliance is not optional. Organizations must comply with every applicable law, regulation, and standard in every jurisdiction where they operate. Ignorance of a regulation is not a defense; compliance must be actively managed.

• Compliance vs. security: Compliance and security are related but not identical. A compliant organization has met minimum regulatory standards. A secure organization has implemented controls appropriate to its actual risk profile. Compliance establishes the floor; security extends above it. An organization can be compliant but still be breached if the regulations set a low bar.
• Chief Compliance Officer (CCO): The CCO is the executive responsible for overseeing the organization's internal compliance program. Responsibilities include monitoring regulatory changes, ensuring compliance obligations are documented and met, managing internal audit and reporting processes, and reporting compliance status to the board. In some organizations the CCO role is combined with the Chief Risk Officer (CRO) or Chief Legal Officer (CLO).
• Penalties for non-compliance: Depending on the regulation and the severity of the violation, consequences include civil fines, criminal fines, imprisonment for executives, suspension or revocation of operating licenses, mandatory corrective action plans, public disclosure requirements, and contractual termination by customers who require compliance certification.

Key Regulatory Frameworks

Three major US regulatory frameworks appear frequently on Security+ examinations:

• SOX (Sarbanes-Oxley Act, 2002): Enacted in response to the Enron and WorldCom accounting scandals. Applies to publicly traded companies and their auditors. Section 404 requires management and external auditors to assess and report on internal controls over financial reporting. IT systems that support financial reporting must maintain integrity, access controls, and audit logging. Criminal penalties for willful non-compliance including imprisonment.
• HIPAA (Health Insurance Portability and Accountability Act): Governs the handling of Protected Health Information (PHI) by covered entities (healthcare providers, health plans, healthcare clearinghouses) and their business associates. Requires administrative, physical, and technical safeguards for PHI. HIPAA enforcement is conducted by the HHS Office for Civil Rights (OCR). Penalties range from civil fines to criminal prosecution depending on the nature and intent of the violation.
• GLBA (Gramm-Leach-Bliley Act, 1999): Governs how financial institutions handle customer financial information. The Financial Privacy Rule requires financial institutions to explain their information-sharing practices and allow customers to opt out of certain sharing. The Safeguards Rule requires financial institutions to implement security programs to protect customer financial data. Applies to banks, insurance companies, securities firms, and other financial services providers.

HIPAA Penalty Tiers and Real-World Compliance Consequences

HIPAA establishes a tiered penalty structure that scales based on the nature and intent of the violation. Understanding the penalty tiers illustrates how regulators treat compliance violations of varying severity — and demonstrates the real consequences of inadequate security programs.

HIPAA Criminal Penalty Tiers

HIPAA criminal penalties escalate based on the violator's intent and knowledge:

• Class 6 (lowest): Unknowing violation of HIPAA — the violator did not know they were violating the law. Penalty: up to $50,000 and/or up to 1 year imprisonment.
• Class 5: Violation under false pretenses — the violator knew they were disclosing PHI improperly. Penalty: up to $100,000 and/or up to 5 years imprisonment.
• Class 4 (highest criminal): Violation with intent to sell, transfer, or use PHI for commercial advantage, personal gain, or malicious harm. Penalty: up to $250,000 and/or up to 10 years imprisonment.

Civil penalties: In addition to criminal penalties, HIPAA civil fines can reach $25,000 per year per identical type of violation. Multiple violation types in the same year multiply the potential civil penalty.

Real-World Consequences: The Uber Case Study

The Uber data breach illustrates the range of consequences that compliance and disclosure failures create:

• Compliance consequences demonstrated: Financial penalties ($148M settlement). Criminal prosecution of a senior executive. Reputational damage that affected customer trust and regulatory relationships. Contractual impacts from state and federal investigations.
• What the Uber case teaches: Paying an attacker to conceal a breach is not a risk management strategy — it is obstruction. Breach notification requirements exist to protect individuals. Violating them by concealing a breach transforms a security incident into a criminal matter.

Other Compliance Consequences

• Loss of operating license: Regulated industries (banking, healthcare, financial services, telecommunications) require licenses to operate. Repeated or severe compliance violations can result in license suspension or revocation, effectively shutting down the business.
• Contractual breach: Many commercial contracts require compliance certification. A business that loses PCI DSS compliance may lose the right to process payment cards. A government contractor that loses CMMC certification may lose federal contracts. Compliance certification is often a prerequisite for doing business.

Due Care, Attestation, and Compliance Monitoring

Beyond meeting specific regulatory requirements, organizations must demonstrate that they are actively managing their compliance posture. Three related concepts form the foundation of proactive compliance management: due care, due diligence, and attestation. Compliance monitoring operationalizes these concepts in ongoing daily activity.

Due Care vs. Due Diligence

Due care and due diligence are complementary concepts that describe how an organization demonstrates reasonable, responsible behavior in managing security and compliance obligations.

• Due care: The internal activities an organization performs to ensure it is managing its own security and compliance obligations responsibly. Due care refers to what the organization does within its own operations: implementing security policies, training employees, applying patches, monitoring systems, and conducting internal audits. Due care asks: "Are we doing what a reasonable, responsible organization should do?"
• Due diligence: The activities an organization performs to evaluate and monitor third parties: vendors, partners, suppliers, and service providers. Due diligence asks: "Are the third parties we rely on also meeting appropriate security and compliance standards?" Vendor due diligence (background checks, security questionnaires, right-to-audit) is the operational form of due diligence.
• Memory distinction: Due care = internal. Due diligence = external (third parties). Both are required for a complete compliance program.

Attestation

Attestation is the formal process by which an executive or authorized individual signs off on compliance documentation, certifying that it is accurate and complete to the best of their knowledge. Attestation creates legal accountability for the signatory.

• What attestation means: When an executive attests to a compliance report, they are asserting — under penalty of law — that the information contained in the report accurately represents the organization's compliance status. This is why SOX requires CFO and CEO attestation of financial statements: it creates personal criminal liability for executives who sign off on fraudulent reports.
• Forms of attestation: SOX management assessments signed by CEO and CFO, HIPAA compliance certifications, PCI DSS compliance declarations, and vendor compliance questionnaires signed by the vendor's security officer all involve attestation.
• Consequences of false attestation: Signing a false compliance attestation is not merely a compliance failure — it may constitute fraud or perjury. The Uber case illustrates how executives who make false representations in compliance contexts face criminal prosecution.

Compliance Monitoring

Compliance monitoring is the ongoing process of verifying that the organization continues to meet its compliance obligations over time. Compliance is not a one-time achievement — it must be maintained continuously as systems change, regulations evolve, and the business grows.

• Internal monitoring tools: Automated compliance dashboards, configuration management databases (CMDBs), policy compliance scanners, log management and SIEM systems, vulnerability scanners integrated with compliance benchmarks (CIS benchmarks, DISA STIGs).
• External auditors: Independent auditors verify compliance claims that internal teams make. Regulatory audits (OCR HIPAA audits, SEC SOX reviews, PCI QSA assessments) provide external assurance. External auditors catch gaps that internal teams may miss due to familiarity bias.
• Automation requirement: Large organizations manage thousands of systems across multiple regulatory frameworks. Manual compliance checking at this scale is impractical. Automation is not optional for mature compliance programs — it is essential for maintaining continuous visibility into compliance posture without overwhelming security and compliance staff.