Principles of Information Security: Legal, Regulatory, and Compliance (GDPR, HIPAA, PCI‑DSS, SOX)

Legal, Regulatory, and Compliance (GDPR, HIPAA, PCI‑DSS, SOX)

Legal, Regulatory, and Compliance (GDPR, HIPAA, PCI-DSS, SOX) – Exam-Ready Study Guide

What This Is

Legal, regulatory, and compliance (LRC) frameworks ensure organizations protect sensitive data, avoid fines, and maintain trust. These rules (like GDPR, HIPAA, PCI-DSS, and SOX) define how data must be handled, stored, and secured. Failure to comply can lead to massive penalties, lawsuits, or breaches—like the 2017 Equifax breach (PCI-DSS violation, $700M+ in fines) or Uber’s 2016 GDPR fine (€10M for hiding a data leak). Security professionals must know these laws to design controls, respond to incidents, and pass audits.

Key Terms & Concepts

• GDPR (General Data Protection Regulation):
  EU law (2018) protecting personal data of EU citizens. Key rights: Right to erasure, data portability, breach notification within 72 hours. Fines: Up to 4% of global revenue or €20M (whichever is higher). Tools: OneTrust, TrustArc (privacy management).

• HIPAA (Health Insurance Portability and Accountability Act):
  U.S. law protecting PHI (Protected Health Information). Key rules: Privacy Rule (patient rights), Security Rule (technical safeguards), Breach Notification Rule (60-day reporting). Fines: Up to $1.5M/year per violation. Tools: Epic, Cerner (HIPAA-compliant EHRs).

• PCI-DSS (Payment Card Industry Data Security Standard):
  Global standard for securing cardholder data (CHD). 12 requirements (e.g., encrypt transmission, restrict access). Fines: $5K–$100K/month for non-compliance. SAQ (Self-Assessment Questionnaire) determines compliance level. Tools: Qualys, Trustwave (PCI scanning).

• SOX (Sarbanes-Oxley Act):
  U.S. law (2002) for financial reporting integrity (post-Enron). Key sections: 302 (CEO/CFO certification), 404 (internal controls), 802 (document retention). Fines: Up to $5M + 20 years prison for fraud. Tools: SAP GRC, RSA Archer.

• PII (Personally Identifiable Information):
  Data that can identify an individual (e.g., SSN, email, biometrics). GDPR/HIPAA protect PII; PCI-DSS protects CHD (a subset of PII).

• PHI (Protected Health Information):
  HIPAA term for health-related PII (e.g., medical records, lab results). De-identified PHI (removed identifiers) is not covered.

• Data Controller vs. Data Processor (GDPR):

• Controller: Decides why and how data is processed (e.g., a hospital).

• Processor: Handles data on behalf of the controller (e.g., cloud provider). Both are liable under GDPR.

• DPO (Data Protection Officer):
  Mandatory under GDPR (for public authorities or large-scale processing). Role: Ensures compliance, reports to highest management, acts as contact for supervisory authorities (e.g., CNIL in France).

• Breach Notification:

• GDPR: 72 hours to report to authorities.
• HIPAA: 60 days to notify affected individuals.

• PCI-DSS: Immediate reporting to payment brands (Visa, Mastercard).

• Audit vs. Assessment:

• Audit: Formal, third-party evaluation (e.g., PCI-DSS ROC – Report on Compliance).

• Assessment: Internal review (e.g., HIPAA Security Risk Assessment).

• Safe Harbor vs. Privacy Shield:

• Safe Harbor (2000–2015): EU-U.S. data transfer framework (invalidated by Schrems I).

• Privacy Shield (2016–2020): Replacement (invalidated by Schrems II). Now use SCCs (Standard Contractual Clauses) or BCRs (Binding Corporate Rules).

• NIST CSF (Cybersecurity Framework):
  Voluntary framework (Identify, Protect, Detect, Respond, Recover) to align security with business risks. Not a law, but often referenced in compliance (e.g., HIPAA, SOX).

Step-by-Step / Process Flow

How to Ensure Compliance (GDPR/HIPAA/PCI-DSS/SOX)

1. Identify Applicable Laws
2. Ask: Who are our customers? (EU? → GDPR), Do we handle health data? (U.S. → HIPAA), Do we process payments? (PCI-DSS), Are we a public company? (SOX).

3. Tool: Compliance mapping matrix (e.g., NIST SP 800-66 for HIPAA).

4. Conduct a Gap Analysis

5. Compare current controls vs. requirements.
6. Example: PCI-DSS Requirement 3 (encrypt CHD) → Check if AES-256 is used.

7. Tool: Nessus, OpenVAS (vulnerability scanning), Drata, Vanta (automated compliance).

8. Implement Controls

9. Technical: Encryption (TLS 1.2+), MFA, DLP (Data Loss Prevention).
10. Administrative: Policies (e.g., Acceptable Use Policy), training (annual HIPAA/GDPR awareness).
11. Physical: Badge access, CCTV (for data centers handling CHD/PHI).

12. Example: HIPAA Security Rule → Access controls (45 CFR § 164.310).

13. Document Everything

14. Policies & Procedures: Incident response plan, data retention policy.
15. Evidence: Logs (SIEM), training records, audit trails.

16. Example: SOX Section 404 → Document internal controls (e.g., change management logs).

17. Train Employees & Monitor Compliance

18. Training: Annual GDPR/HIPAA/PCI-DSS training (track completion).
19. Monitoring: SIEM alerts (e.g., unauthorized access to CHD), quarterly access reviews.

20. Tool: KnowBe4 (phishing tests), Splunk (log analysis).

21. Prepare for Audits & Respond to Incidents

22. Audits: PCI-DSS ROC (Report on Compliance), HIPAA OCR audits.
23. Incidents: Follow breach notification timelines (GDPR: 72h, HIPAA: 60d).
24. Tool: Incident response playbook, forensic tools (FTK, Autopsy).

Common Mistakes

Certification Exam Tips

CISSP

• Focus: Governance, risk, and compliance (GRC) – expect scenario-based questions (e.g., "Which law applies to a U.S. hospital storing EU patient data?" → GDPR + HIPAA).
• Tricky Distinction: GDPR (EU) vs. CCPA (California) – GDPR is opt-in, CCPA is opt-out.
• Management Trap: CISSP tests policy/process, not technical details (e.g., "What’s the first step in a HIPAA compliance program?" → Gap analysis).

Security+

• Focus: Key requirements (e.g., "Which PCI-DSS requirement mandates MFA for remote access?" → Requirement 8.3).
• Acronym Overload: Memorize GDPR (72h breach), HIPAA (60d), PCI-DSS (12 requirements).
• Exam Trap: SOX applies to public companies, not all businesses.

CEH

• Focus: How attackers exploit compliance gaps (e.g., "Which attack vector is most likely to violate PCI-DSS?" → SQLi stealing CHD).
• Real-World Link: PCI-DSS Requirement 6 (patch management) – unpatched systems = easy exploits.

Quick Check Questions

1. A U.S. healthcare provider stores patient records in AWS (EU region). Which laws apply?
2. A) HIPAA only
3. B) GDPR only
4. C) HIPAA + GDPR

5. D) PCI-DSS + SOX
   ✅ Correct Answer: C
   Explanation: HIPAA applies to U.S. health data; GDPR applies because data is stored in the EU.

6. A company suffers a ransomware attack encrypting credit card data. What’s the first compliance step?

7. A) Pay the ransom
8. B) Notify customers within 24h
9. C) Report to payment brands (Visa/Mastercard) immediately

10. D) Conduct a forensic investigation
    ✅ Correct Answer: C
    Explanation: PCI-DSS requires immediate reporting to payment brands (even before notifying customers).

11. Which SOX section requires CEOs/CFOs to certify financial reports?

12. A) Section 302
13. B) Section 404
14. C) Section 802
15. D) Section 906
    ✅ Correct Answer: A
    Explanation: SOX 302 mandates CEO/CFO certification of financial reports.

Last-Minute Cram Sheet

1. GDPR: 72h breach notification, 4% global revenue fine, DPO required for large-scale processing.
2. HIPAA: 60d breach notification, $1.5M/year fine, PHI = health-related PII.
3. PCI-DSS: 12 requirements, immediate breach reporting, SAQ for self-assessment.
4. SOX: Section 302 (CEO certification), 404 (internal controls), 802 (document retention).
5. PII vs. PHI vs. CHD:
6. PII = Any identifiable data (GDPR).
7. PHI = Health data (HIPAA).
8. CHD = Credit card data (PCI-DSS).
9. Breach Notification Deadlines:
10. GDPR: 72h → HIPAA: 60d → PCI-DSS: immediate.
11. ⚠️ GDPR applies to EU citizens, even if the company is outside the EU.
12. ⚠️ HIPAA applies to covered entities (hospitals, insurers) + business associates (vendors).
13. ⚠️ PCI-DSS applies to any organization handling credit card data (even small businesses).
14. ⚠️ SOX applies only to public companies (not private or non-profits).

Final Tip: Memorize the "big 4" (GDPR, HIPAA, PCI-DSS, SOX) + their key deadlines/fines. Most exam questions test which law applies in a scenario. Good luck! ?