Build the obligations register you are measured against

short · 35 min · Objective 5.4

Task

Work out which obligations apply to a described organisation, what each requires, and what happens if it is not met. Compliance you do not know you owe is compliance you are failing, and the register is what makes it visible.

Steps

  1. Describe the organisation in /tmp/org.md: what it does, where it operates, whose data it holds, whether it takes card payments, and which sector it is in. Make it specific enough to have real obligations.
  2. Write /tmp/obligations.csv with the columns obligation,source_type,what_it_requires,evidence,consequence_of_failure,owner.
  3. Fill in at least six, and make sure source_type covers more than one kind: regulatory, legal, industry and contractual.
  4. For each, write the EVIDENCE that would demonstrate compliance — not the control, the evidence. An auditor accepts a configuration export and a log; they do not accept an assurance.
  5. For each, write the consequence specifically: a fine calculated how, an order to do what, a contract terminable by whom.
  6. Mark the one whose consequence would be fastest to arrive. For most organisations taking card payments, it is not the regulator.

Verify

python3 - <<'PY'
import csv
rows=list(csv.DictReader(open('/tmp/obligations.csv')))
assert len(rows)>=6, 'fewer than six obligations'
kinds={r['source_type'].strip().lower() for r in rows}
print('source types:',kinds)
assert len(kinds)>=3, 'fewer than three kinds of source - regulatory, legal, industry and contractual are different'
for r in rows:
    assert r['evidence'].strip(), 'no evidence named for '+r['obligation'][:30]
    assert r['owner'].strip(), 'no owner for '+r['obligation'][:30]
    c=r['consequence_of_failure'].lower()
    assert len(c)>15, 'consequence too vague for '+r['obligation'][:30]
print(len(rows),'obligations, all evidenced and owned')
PY
grep -ciE "card|processing|licence|stop" /tmp/obligations.csv

The three-source-types assertion is the point: organisations track regulation and forget that a contract with a large customer, or an industry standard like PCI DSS, imposes obligations with faster and sharper consequences than most regulators impose.

Notes

The fastest consequence is usually contractual or industry, not regulatory. Losing the ability to process card payments arrives in weeks and stops the business; a regulatory investigation takes months and produces a fine. Both matter, and only one of them is what people plan for.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.