Lion Cipher Lab
Build a compliance obligations register and resolve conflicting deadlines
- GRC / Compliance
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Security and compliance programmes are usually organized around frameworks: an ISO 27001 project, a PCI DSS assessment, a GDPR programme. But an organization's real obligations come from three kinds of source, and frameworks cover only one of them. Laws and regulations, such as GDPR. Standards the organization has committed to, such as PCI DSS for anyone handling card data. And contracts: customer agreements, data processing agreements and supplier terms, which often contain security and notification requirements stricter than any law. NIST CSF 2.0 expects legal, regulatory and contractual…
What you'll learn
- what a compliance obligation is, and its three sources (law, standard, contract)
- building an obligations register with owners, controls and evidence
- breaking a requirement into testable obligations
- finding overlapping obligations triggered by the same event
- resolving conflicts: the strictest applicable requirement wins
- keeping the register current
- how the register feeds policies, controls and audits
Steps in this lab
- Obligations, and where they come from
- Extract obligations from three sources
- Build the register
- Find the overlap: one event, three deadlines
- Keep the register alive