CISSP - compliances, acts, standards, etc
CISSP — Laws, Standards & Frameworks Master Reference
A consolidated list of everything commonly tested in CISSP Domain 1 (Legal, Regulatory, Compliance) and Domain 3 (Security Architecture standards). Organized so you can scan by industry, prioritize by importance, and drill the ELI5 + key takeaway fast.
Importance scale: 🔴 Must-know cold | 🟡 Know the core concept | 🟢 Recognize the name, don't deep-dive
PART 1 — LAWS & REGULATIONS (Legal/Regulatory — mostly Domain 1)
| Law / Act | Region | Industry / Field | Importance | ELI5 | Key Takeaways |
|---|---|---|---|---|---|
| HIPAA (Health Insurance Portability and Accountability Act) | US | Healthcare | 🔴 | Protects patient health info — doctors, insurers, and their vendors must keep it private and secure. | Covers "PHI" (Protected Health Information). Applies to "covered entities" + "business associates." Has a Privacy Rule (who can see data) and Security Rule (how to protect it technically). |
| GDPR (General Data Protection Regulation) | EU | All industries (any org handling EU residents' data) | 🔴 | The strictest, most-copied privacy law — gives individuals strong control over their own data, no matter where the company is based. | Data subject rights (access, erasure/"right to be forgotten," portability), requires consent, 72-hour breach notification, huge fines (4% global revenue or €20M), Data Protection Officer (DPO) requirement, "privacy by design and default" (Article 25). |
| GLBA (Gramm-Leach-Bliley Act) | US | Financial services / banking | 🔴 | Banks and financial institutions must explain how they share your data and protect it. | Has a Financial Privacy Rule + Safeguards Rule. Requires written information security programs at financial institutions. |
| SOX (Sarbanes-Oxley Act) | US | Publicly traded companies (finance/accounting) | 🔴 | After major corporate accounting scandals (Enron), this law forces public companies to prove their financial records are accurate and controlled. | About financial reporting integrity and internal controls — not "security" in the traditional sense, but IT controls supporting financial systems fall under it. Executives can be personally liable. |
| PCI DSS (Payment Card Industry Data Security Standard) | Global (industry-mandated, not law) | Any org that processes credit/debit card payments | 🔴 | Card networks (Visa, Mastercard, etc.) created their own security rulebook — if you touch card data, you must follow it. | Not a government law — a contractual/industry standard. 12 core requirements (network security, encrypt cardholder data, access control, monitoring, etc.). Non-compliance = fines/loss of ability to process cards. |
| COPPA (Children's Online Privacy Protection Act) | US | Any online service that may collect data from children under 13 | 🟡 | Websites/apps can't collect data from kids without a parent's permission. | Applies specifically to under-13 users. Requires verifiable parental consent before data collection. |
| FERPA (Family Educational Rights and Privacy Act) | US | Education | 🟡 | Protects student education records; schools can't share grades/records without consent. | Applies to schools receiving federal funding. Parents/students have right to access and request correction of records. |
| FISMA (Federal Information Security Management Act) | US | US federal government agencies | 🟡 | Requires federal agencies to have a formal, documented information security program. | Ties directly to NIST 800-53 (the controls) and the Risk Management Framework (RMF) — FISMA is the law, NIST 800-53/RMF is how you comply with it. |
| Privacy Act of 1974 | US | US federal government agencies | 🟡 | Governs how federal agencies (not private companies) collect and handle citizens' personal data. | Applies ONLY to federal agencies — classic exam trap is confusing it with private-sector laws. Individuals can access/correct their records; agencies must publish notice of record systems; primarily civil (not criminal) remedy. |
| CCPA / CPRA (California Consumer Privacy Act / Privacy Rights Act) | US (California) | All industries doing business with CA residents | 🟡 | California's version of GDPR — gives state residents rights over their personal data. | Right to know, delete, opt-out of sale of personal data. CPRA (2023) strengthened CCPA and created a dedicated enforcement agency (CPPA). |
| ECPA (Electronic Communications Privacy Act) | US | All industries — electronic communications/wiretapping | 🟢 | Sets rules for when the government (or others) can intercept phone calls, email, and other digital communications. | Includes the Wiretap Act and Stored Communications Act. Relevant to monitoring employee communications legally. |
| CFAA (Computer Fraud and Abuse Act) | US | All industries — cybercrime | 🟡 | The main US law that makes unauthorized computer access a federal crime. | Covers hacking, exceeding authorized access, and — relevant to your earlier honeypot question — is the statute usually cited for attacker liability. |
| DPDP Act (Digital Personal Data Protection Act) | India | All industries handling Indian residents' data | 🟢 | India's GDPR-equivalent — newer law, less deeply tested but worth recognizing given your location. | Consent-based data processing, data fiduciary/processor roles, breach notification requirements. |
| LGPD (Lei Geral de Proteção de Dados) | Brazil | All industries | 🟢 | Brazil's GDPR-equivalent. | Same underlying logic as GDPR — recognize as "GDPR but Brazil," don't over-invest time. |
| PIPEDA | Canada | All industries | 🟢 | Canada's private-sector privacy law. | Consent-based, similar spirit to GDPR but less strict. Mostly just recognize the name. |
PART 2 — SECURITY / MANAGEMENT STANDARDS & FRAMEWORKS (mostly Domain 1 & 3)
| Standard / Framework | Governing Body | Field / Scope | Importance | ELI5 | Key Takeaways |
|---|---|---|---|---|---|
| ISO/IEC 27001 | ISO | Information Security Management (ISMS) — all industries | 🔴 | The main international "how to run a security program properly" certification. | You can get formally CERTIFIED against 27001. Uses PDCA cycle (Plan-Do-Check-Act). Requires risk assessment + a "Statement of Applicability" listing which controls you use. |
| ISO/IEC 27002 | ISO | Companion to 27001 — detailed control guidance | 🔴 | The "how-to" instruction manual for the controls listed in 27001. | Not certifiable on its own — it's implementation guidance, not requirements. |
| ISO/IEC 27005 | ISO | Risk management for information security | 🟡 | ISO's specific playbook for doing security risk assessments. | Pairs with 27001 — used during the "risk assessment" phase of building an ISMS. |
| ISO 27701 | ISO | Privacy Information Management System (PIMS) | 🟡 | Extension of 27001 specifically for privacy management. | Bridges security (27001) and privacy (GDPR-style requirements) into one certifiable system. |
| ISO 22301 | ISO | Business Continuity Management | 🟡 | The certification for "can your business survive and recover from a disaster." | Directly ties to Domain 7 (BCP/DRP). |
| ISO 31000 | ISO | General (non-security-specific) risk management | 🟢 | A generic risk management framework, not security-specific. | Recognize it's broader than security — general enterprise risk. |
| NIST CSF (Cybersecurity Framework) | NIST (US) | Cybersecurity risk management — voluntary, US-centric but globally used | 🔴 | A flexible, widely-adopted framework for assessing and improving your cybersecurity maturity. | 5 core functions: Identify, Protect, Detect, Respond, Recover (memorize this — tested constantly). Not certifiable — it's a maturity/self-assessment tool. |
| NIST 800-53 | NIST (US) | Detailed security controls — primarily US federal systems | 🔴 | The giant, detailed rulebook of specific security controls federal systems must implement. | Organized into control families (Access Control, Audit, Incident Response, etc.). Required for FISMA compliance. |
| NIST RMF (Risk Management Framework) | NIST (US) | Process for applying 800-53 controls | 🟡 | The step-by-step process for how a federal system gets approved to operate securely. | Steps: Categorize → Select → Implement → Assess → Authorize → Monitor. Ends in an "ATO" (Authority to Operate). |
| COBIT | ISACA | IT governance vs. management — general IT, all industries | 🔴 | The framework specifically about the difference between "setting IT direction" (governance) vs. "running IT day to day" (management). | Governance = Evaluate, Direct, Monitor (EDM domain). This is THE framework for governance-vs-management questions (see your earlier questions today). |
| ITIL | AXELOS | IT Service Management — all industries | 🟡 | The playbook for running IT operations smoothly — incidents, changes, service requests. | This is the "management/operations" layer, NOT governance. Covers incident management, change management, service desk. |
| COSO | COSO (accounting-origin body) | Internal controls / enterprise risk — mostly finance-adjacent | 🟢 | An internal-controls framework originally built to prevent financial fraud (ties into SOX compliance). | Recognize it as the framework behind SOX internal control requirements. Don't deep-dive unless a question explicitly mentions financial reporting controls. |
| CIS Controls (Center for Internet Security) | CIS | Practical, prioritized technical security controls — all industries | 🟡 | A prioritized "top things to do first" checklist for security, more tactical/practical than ISO or NIST. | Good for real-world prioritization questions — "what should you implement FIRST" type scenarios. |
| PCI DSS | (see Part 1 — listed there since it's industry-specific to payments) | ||||
| Common Criteria (ISO 15408) | ISO / international | Security evaluation of IT PRODUCTS (not organizations) | 🟡 | A standardized way to rate how secure a specific product (firewall, OS, etc.) is, so buyers can compare. | Produces "Evaluation Assurance Levels" (EAL 1–7). Different from the ISO 27000 family — this evaluates products, not organizations. |
PART 3 — PRIVACY-SPECIFIC PRINCIPLES (not laws, but tested concepts)
| Concept | Origin | Field | Importance | ELI5 | Key Takeaways |
|---|---|---|---|---|---|
| Privacy by Design (PbD) | Ann Cavoukian (Ontario) | All industries — system/architecture design | 🔴 | Build privacy INTO systems from day one, don't bolt it on later. | 7 principles (we covered these in depth). Legal backbone behind GDPR Article 25. |
| Due Care | Legal (negligence law origin) | All industries | 🔴 | Taking reasonable, expected action to protect something — "the prudent person standard." | Action-oriented. Pairs with due diligence. |
| Due Diligence | Legal (negligence law origin) | All industries | 🔴 | Researching/investigating BEFORE acting — "doing your homework." | Investigation-oriented. Comes before due care in sequence. |
What I deliberately left OUT (and why)
To keep this list honest and exam-relevant rather than padded:
- ISO 15489-1 (records management) — confirmed not in CISSP's official CBK scope; excluded per our earlier discussion.
- Extremely niche regional laws (most non-US/EU/India privacy laws) — CISSP tests the concept of regional privacy law variation more than memorizing every country's specific act.
- Deprecated/superseded standards (e.g., old EU Data Protection Directive, since GDPR replaced it) — not tested, GDPR is what matters now.
How to actually use this table
Given how you process information best — talking things through rather than passive re-reading — I'd suggest: pick one 🔴 row a day, and try to explain it out loud in your own words, then test yourself with a "which of these is NOT a requirement of X" style question, the same pattern we drilled today with the Privacy Act. That active-recall + verbal-explanation combo will stick far better than reading this table top to bottom once.