Governance and compliance¶

Who decides what "secure enough" means, how that is written down, and how anyone proves it: risk management, control frameworks, regulation, audits and the certs that test them.

flowchart TB
  RISK[Risk management:<br/>what could go wrong, how bad] --> POLICY[Policy and controls]
  LAW[Laws and regulation:<br/>privacy, sector rules] --> POLICY
  FW[Frameworks:<br/>NIST CSF, ISO 27001, CIS] --> POLICY
  POLICY --> EVID[Evidence:<br/>logs, tickets, configs]
  EVID --> AUDIT[Audit or assessment]
  AUDIT -.findings.-> RISK

Risk, law and frameworks all shape the controls you adopt; audits test the evidence and feed findings back into the risk register.

Learn¶

Risk management basics - registers, appetite, ALE and the four risk responses
Privacy engineering basics - data minimisation, PII inventory and DSAR handling
Shared responsibility model - who secures what, per service tier
Security awareness training - a control most frameworks require
Data loss prevention explained - classification, discovery and DLP policies
Least privilege explained - the access control auditors ask about first

Frameworks and standards¶

Sector and privacy rules¶

Reference¶

Case study: Capital One 2019 - a breach that led to regulatory penalties
Case study: Change Healthcare 2024 - HIPAA-regulated data and sector concentration
Case study: Snowflake customer breaches 2024 - shared responsibility for SaaS
Interview prep: GRC and audit
GRC analyst roadmap

Certify¶

ISACA CISA - audit
ISACA CISM - management
CISSP (ISC2) - security and risk management domain
CCSP (ISC2) - cloud governance and legal
CCSK v5 (Cloud Security Alliance)
Microsoft Security, Compliance, and Identity (SC-900)
Microsoft Information Security Administrator (SC-401) - information protection and compliance