6.4. Security Compliance
💡 First Principle: Compliance proves that the organization meets its security obligations — regulatory, contractual, and internal. Compliance monitoring detects gaps before auditors or breaches find them. Privacy considerations ensure that personal data is handled according to legal and ethical requirements. Compliance is not the same as security (a compliant organization can still be breached), but non-compliance guarantees penalties regardless of whether a breach occurs.
What happens when compliance lapses? Fines (GDPR penalties can reach 4% of global annual revenue), lawsuits (class-action suits from affected individuals), sanctions (loss of operating licenses), loss of business (customers requiring compliance certifications), and reputational damage. Equifax paid over $700 million in breach-related costs. Non-compliance converts security incidents into existential business threats.
Without a working knowledge of what non-compliance actually costs, it's easy to underestimate why a security program needs governance buy-in at all.
Think of compliance fines like a second, delayed cost of the same breach — the incident response bill arrives first, and the regulatory bill arrives months later, often far larger.
⚠️ Exam Trap: GDPR fines can reach up to 4% of global annual revenue or €20 million, whichever is greater. HIPAA fines range from $100 to $50,000 per violation — the exam expects you to recognize these are very different penalty structures.
