Compliance terms are pretty badly abused, even by professionals within the cybersecurity and privacy industries. Words have meaning and non-compliance can have negative ramifications. Cybersecurity, IT and privacy professionals routinely abuse the terms “law” and “regulation” as if they are synonymous, but those terms have unique meanings that need to be understood.
ComplianceForge compiled the information on this page to help get everyone on the same sheet of music, since words do have meanings and it is important to understand the risks associated with cybersecurity and privacy requirements, since not all compliance obligations have the same weight.
Understanding the “hierarchy of pain” with compliance leads to well-informed risk decisions that influence technology purchases, staffing resources and management involvement. That is why it serves both cybersecurity and IT professionals well to understand the compliance landscape for their benefit, since you can present issues of non-compliance in a compelling business context to get the resources you need to do your job.
Beyond just using terminology properly, understanding which of the three types of compliance is crucial in managing both cybersecurity and privacy risk within an organization. The difference between non-compliance penalties can be as stark as:
When discussing cybersecurity and privacy requirements, the term "must" is often thrown around as an absolute. This is most often due to an applicable law, regulation or contract clause that is compelling the control to exist.
Secure and compliant operations exist when both MCR and DSR are implemented and properly governed :
Statutory obligations are required by law and refer to current laws that were passed by a state or federal government. From a cybersecurity and privacy perspective, statutory compliance requirements include:
US - Federal Laws
US - State Laws
International Laws
Regulatory obligations are required by law, but are different from statutory requirements in that these requirements refer to rules issued by a regulating body that is appointed by a state or federal government. These are legal requirements through proxy, where the regulating body is the source of the requirement. It is important to keep in mind that regulatory requirements tend to change more often than statutory requirements. From a cybersecurity and privacy perspective, regulatory compliance examples include:
US Regulatory Requirements
International Regulatory Requirements
Contractual obligations are required by legal contract between private parties . This may be as simple as a cybersecurity or privacy addendum in a vendor contract that calls out unique requirements. It also includes broader requirements from an industry association that membership brings certain obligations. From a cybersecurity and privacy perspective, common contractual compliance requirements include:
Questions? Please contact us for clarification so that we can help you find the right solution for your cybersecurity and privacy compliance needs.
Secure Controls Framework (SCF) Secure Controls Framework (SCF) "Premium Content" - Expertise-Class Policies, Control Objectives, Standards, Guidelines, Controls & Metrics. Product Walkthrough Video This short product walkthrough video is designed to give a brief overview about.
Questions about our products?
Our customer service is here to help you get answers quickly!
Find out the importance of these documents for your business.
Read exclusive information about cybersecurity from Compliance Forge.
Veteran-Owned Small Business (VOSB) | DUNS: 080724402 | CAGE Code: 7XAZ4 | NAICS Codes: 541690, 541519, & 541611
© Compliance Forge, LLC (ComplianceForge). All Rights Reserved.
This website does not render professional services advice and is not a substitute for dedicated professional services. If you have compliance questions, you should consult a cybersecurity or privacy professional to discuss your specific needs. Compliance Forge, LLC (ComplianceForge) disclaims any liability whatsoever for any documentation, information, or other material which is or may become a part of the website. ComplianceForge does not warrant or guarantee that the information will not be offensive to any user. User is hereby put on notice that by accessing and using the website, user assumes the risk that the information and documentation contained in the web site may be offensive and/or may not meet the needs and requirements of the user. The entire risk as to the use of this website is assumed by the user.
ComplianceForge reserves the right to refuse service, in accordance with applicable statutory and regulatory parameters.
