Security, Confidentiality, and Privacy: The Regulatory and Framework Landscape (CPA ISC Area II.A)

Regulation

A legally enforceable requirement imposed by governments or agencies.

Standard

A documented set of requirements or criteria that can be either mandatory or voluntary.

Framework

An organized way to design, manage, and evaluate a security/privacy program.

Noncompliance

Failure to adhere to regulations, which can lead to penalties.

Outcomes

What must be achieved according to regulations (e.g., protecting personal information).

Mandatory Standards

Standards that are required due to contracts or industry rules.

Voluntary Standards

Standards adopted by organizations to improve security or demonstrate maturity.

Control Objectives

Testable goals established from legal obligations that outline desired control outcomes.

Evidence

Documents or records demonstrating that controls are implemented and effective.

Compliance

Adhering to regulations, standards, and frameworks to avoid penalties.

Vendor Oversight

Managing and assessing third-party service providers to ensure compliance with relevant standards.

HIPAA

A U.S. regulation focused on the privacy and security of health information.

GDPR

European privacy regulation that establishes rights for individuals regarding their personal data.

CCPA/CPRA

California privacy law emphasizing consumer rights and data transparency.

Breach Notification Laws

Regulations requiring organizations to notify individuals and regulators about data breaches.

NIST Cybersecurity Framework

A framework for structuring a cybersecurity program, organizing activities into five core functions.

SOC Report

A report evaluating controls at a service organization, used for assessing vendor risk.

Type 1 SOC Report

Evaluates if controls are suitably designed at a specific point in time.

Type 2 SOC Report

Evaluates not only control design but also operating effectiveness over a period.

Trust Services Criteria

Evaluation criteria used in SOC 2 engagements, covering security and other domains.

ISO/IEC 27001

A standard defining requirements for establishing an Information Security Management System.

CIS Controls

A prioritized set of best practices for enhancing cybersecurity.

PCI DSS

Industry standard for security practices regarding payment card data.

Complementary User Entity Controls

Controls customers must implement to support the overall control objectives of a service provider.

Data Minimization

A principle requiring that only necessary data is collected and retained.

Continuous Monitoring

Ongoing review and evaluation of controls to ensure effectiveness and compliance.

Scoping

Defining the boundaries of what systems and processes are included in compliance efforts.