Compliance, privacy, and the cost of getting it wrong

Objective 5.4 in this course covers security compliance — CompTIA's scope note for it summarises compliance reporting, consequences of non-compliance, monitoring and privacy. It is the applied lab for 5.4, because a data inventory and a retention schedule are artefacts you can produce and be graded against.

Why this matters

Compliance is where security obligations become enforceable by someone outside the organisation. The exam tests it as consequences and vocabulary, both of which are recall.

The privacy half is where SY0-701 has grown, and it is worth learning precisely. The controller/processor distinction, the data subject's rights, and the difference between retention and minimisation each produce questions with one clearly correct answer.

The lesson

Compliance reporting, internal and external

Compliance is demonstrating that you meet an obligation — a law, a regulation, a contract, a standard you have adopted. The word doing the work is demonstrating: being compliant and being able to show it are different, and only the second passes an audit.

Internal reporting goes to management and the board: which obligations apply, where you stand against each, what the gaps are, and what is being done. Its purpose is decision-making, so it should be frank about failures — internal reporting that only reports good news is worthless as governance.

External reporting goes outside: to regulators, certification bodies, customers under contract, and sometimes the public. It is usually formal, on a defined schedule and in a defined format, and it is a statement the organisation can be held to.

Two things the exam expects you to know about reporting:

• Attestation is a formal statement that something is true, typically signed by someone senior who carries personal responsibility for it. That signature is the mechanism: it converts a corporate claim into an individual's accountability.
• Evidence is what reporting rests on. The Domain 4 habit applies here — the evidence an auditor accepts is a measurement of the running systems, a configuration export, a log, a signed approval, not an assurance that a control exists.

Fines, sanctions, reputational damage, loss of licence and contractual impact

CompTIA's consequences of non-compliance, in rough order of how organisations underestimate them:

• Fines. Monetary penalties, which under modern privacy regimes are calculated as a percentage of global turnover rather than a fixed cap — which is what made them material to large organisations.
• Sanctions. Non-monetary enforcement: an order to stop processing, mandated external audits, a supervision regime, or required remediation on a timetable. An order to stop processing can be more damaging than any fine, because it stops the business rather than costing it money.
• Reputational damage. Customer loss, harder sales, a higher cost of capital and difficulty recruiting. Hard to quantify and frequently the largest actual cost.
• Loss of licence. For regulated industries, the ability to operate at all. The extreme case, and the reason compliance is a board-level concern.
• Contractual impact. Breach of contract with customers who required specific controls, giving them termination rights and damages. PCI DSS's sanction is of this kind: losing the ability to process card payments, which arrives faster than most regulatory processes.

The framing worth carrying: these are not alternatives. A serious failure typically produces several at once — a fine, a supervision order, customer losses and contractual claims — and they arrive on different timescales, with reputational damage lasting longest.

Due diligence and care, attestation and acknowledgement, internal and external monitoring

Four terms CompTIA groups here, and they are examined as definitions.

• Due diligence is the investigation — doing the homework to identify what is required and what the risks are, before committing. The vendor research from 5.3 is due diligence.
• Due care is the ongoing action — doing what a reasonable organisation would do to protect its assets, continuously. Patching, monitoring, training, reviewing.

The memory aid: diligence is finding out, care is acting on it. Legally, failing at either can constitute negligence, and demonstrating both is what makes a defence.

• Attestation and acknowledgement — attestation is the formal signed statement above; acknowledgement is confirming you have received and understood something, such as staff acknowledging the acceptable use policy. Acknowledgement records are what establish that someone knew a rule existed, which matters in a disciplinary or legal process.
• Internal and external monitoring — checking compliance yourself, and being checked by someone else. Both are needed: internal monitoring is continuous and cheap and is marking your own homework; external is periodic, expensive and independent.

Automation in compliance monitoring

CompTIA lists automation explicitly under this objective, and the reason is the gap between audit cycles.

Point-in-time compliance is a snapshot. An organisation can pass an audit in March and be substantially non-compliant by June through ordinary drift, and nothing will say so until the next audit. Continuous compliance monitoring closes that: the checks that an auditor would run are automated and run constantly.

What it looks like in practice, drawing on tooling from Domain 4:

• SCAP-based configuration scanning against the benchmark, per host, per day, producing per-setting compliance;
• cloud posture management checking that storage is not public, encryption is on, logging is enabled and identity policies are not over-permissive;
• policy as code, where the requirement is expressed as an automated check in the deployment pipeline — the guard rails from the automation lesson, which prevent the non-compliant configuration from being created at all;
• automated evidence collection, so producing an audit pack is a report rather than three weeks of screenshots;
• and dashboards and alerting on the compliance position, so drift is an alert rather than a discovery.

The benefit to state: it turns compliance from an event into a state, and it makes the audit cheaper because the evidence already exists. The caution is the one from the automation lesson — an automated check measures what it was written to measure, and a control that nobody automated is invisible in a dashboard that looks complete.

Privacy: legal implications, data subject, controller versus processor, retention, right to be forgotten

Privacy is the part of this objective that has grown, and the vocabulary is exact.

• Data subject — the individual the personal data is about. Privacy law gives them rights; the organisation owes them duties.
• Controller — determines the purposes and means of processing. Carries the legal obligations.
• Processor — processes on the controller's instructions. A processor that starts deciding its own purposes becomes a controller, with the obligations that brings.

In a vendor breach, the controller usually still owes notification to the data subjects. Outsourcing the processing does not outsource the duty — the same "transfer moves the money, not the obligation" point from 5.2.

Legal implications span local, regional, national and global, and the same data can be governed at several levels at once. The practical consequences:

• Data residency and sovereignty from Domain 3, with cross-border transfer needing a lawful mechanism.
• Breach notification, on a clock measured in hours or days — typically to the regulator first and to affected individuals where the risk to them is high. Knowing your obligation before the incident is preparation, not research.
• Lawful basis: personal data needs a reason to be processed at all, and consent is only one of several — and where consent is the basis, it must be freely given and withdrawable.

Data subject rights the exam names: access (a copy of their data), rectification, erasure (the right to be forgotten), restriction, objection, and portability. Each has a response deadline, and each requires that you can find all of a person's data, which is why the data inventory from Domain 4 is a privacy control as much as a security one.

Retention is the balance from Domain 3's data lesson: keep it as long as needed and as long as required, and no longer. Over-retention enlarges every breach, increases discovery cost, and conflicts with erasure requests. Under-retention breaches regulatory requirements and destroys evidence. A legal hold overrides the schedule.

And the control that outperforms all of them: data minimisation. Collect only what you need, keep it only while you need it. Data you never collected cannot be breached, cannot be requested, cannot be subpoenaed, costs nothing to protect and never has to be deleted on request. When an exam scenario asks how to reduce privacy risk structurally rather than by adding controls, minimisation is the answer.

What to take into the exam

• Being compliant and being able to demonstrate it are different; only the second passes an audit.
• An order to stop processing can hurt more than a fine, because it stops the business rather than costing money.
• Due diligence is finding out; due care is acting on it, continuously.
• The controller keeps the notification duty even when the processor caused the breach.
• Consent is one lawful basis among several, and it must be withdrawable.
• Answering access and erasure requests requires knowing where all of a person's data is — the data inventory is a privacy control.