Why This Matters#

Security without governance is ad-hoc and unsustainable. Frameworks provide structure, accountability, and measurability. Compliance ensures you meet legal obligations. But compliance alone is not security — it’s the minimum baseline, not the ceiling.

Governance vs Compliance vs Security#

flowchart TD
    Gov["Governance<br/>(structure, accountability)"]
    Gov --> Risk["Risk Management<br/>(identify, assess, treat)"]
    Gov --> Compliance["Compliance<br/>(meet requirements)"]
    Risk --> Security["Security Controls<br/>(technical + organizational)"]
    Compliance --> Security

Major Frameworks#

ISO 27001 (Information Security Management System)#

International standard for managing information security systematically:

Certification: Third-party audit → certificate valid 3 years (annual surveillance audits).

NIST Cybersecurity Framework (CSF) 2.0#

Voluntary framework organized around six functions:

flowchart LR
    Govern["GOVERN<br/>(strategy, risk)"]
    Identify["IDENTIFY<br/>(assets, risks)"]
    Protect["PROTECT<br/>(safeguards)"]
    Detect["DETECT<br/>(monitoring)"]
    Respond["RESPOND<br/>(incident handling)"]
    Recover["RECOVER<br/>(restoration)"]
    
    Govern --> Identify
    Identify --> Protect
    Protect --> Detect
    Detect --> Respond
    Respond --> Recover

SOC 2 (Service Organization Controls)#

Audit report for service providers, based on Trust Service Criteria:

Type I: Controls designed appropriately (point-in-time). Type II: Controls operating effectively (over 6–12 months).

Comparison#

Regulatory Compliance#

GDPR (General Data Protection Regulation)#

EU regulation for personal data protection:

Key obligations:

• Data Protection Impact Assessment (DPIA) for high-risk processing
• Data breach notification within 72 hours
• Right to erasure (“right to be forgotten”)
• Data Protection Officer (DPO) for certain organizations
• Fines: up to €20M or 4% of global annual revenue

NIS2 (Network and Information Security Directive)#

EU directive for critical infrastructure cybersecurity:

Penalties: Up to €10M or 2% of global revenue.

PCI DSS (Payment Card Industry Data Security Standard)#

Required for anyone processing, storing, or transmitting cardholder data:

Risk Management#

Risk Assessment Process#

flowchart LR
    Context["Establish<br/>Context"] --> Identify["Identify<br/>Risks"]
    Identify --> Analyze["Analyze<br/>(likelihood × impact)"]
    Analyze --> Evaluate["Evaluate<br/>(prioritize)"]
    Evaluate --> Treat["Treat<br/>(mitigate, accept, transfer, avoid)"]
    Treat --> Monitor["Monitor<br/>& Review"]
    Monitor --> Context

Risk Matrix#

Risk Treatment Options#

Risk Register#

Security Policies#

Policy Hierarchy#

flowchart TD
    Policy["Policies<br/>(what and why — board-approved)"]
    Policy --> Standards["Standards<br/>(specific requirements)"]
    Standards --> Procedures["Procedures<br/>(how to do it — step by step)"]
    Procedures --> Guidelines["Guidelines<br/>(recommendations, best practices)"]

Essential Policies#

Data Classification#

Audit and Assurance#

Audit Types#

Audit Preparation#

Continuous Compliance#

Move from point-in-time audits to continuous monitoring:

Key Takeaways#

1. Compliance ≠ security — compliance is the floor, not the ceiling
2. Risk-based approach — prioritize based on actual risk, not checkbox completion
3. Frameworks provide structure — ISO 27001 for certification, NIST CSF for guidance
4. Know your regulations — GDPR, NIS2, PCI DSS have real penalties
5. Document everything — policies, decisions, risk acceptance, evidence
6. Continuous over periodic — automate compliance monitoring
7. Board-level accountability — NIS2 and GDPR hold leadership responsible