Security Governance, Risk & Privacy Topics
Governance, compliance frameworks, regulatory requirements, compliance implementation, and compliance-driven risk management. Covers compliance frameworks (SOX, GDPR, HIPAA, FCPA, etc.), regulatory interpretation, compliance control design, audit and control effectiveness evaluation, and compliance process management. For operational security implementation and technical threat mitigation, see Security Engineering & Operations.
Compliance Frameworks and Certification Standards
The major security compliance frameworks and how to achieve and maintain certification against them: SOC 2, ISO 27001, NIST CSF, NIST 800-53, CIS Controls, PCI DSS, and FedRAMP. Covers what each framework governs, how control families map to organizational practices, and how to scope, prepare for, and pass a certification assessment. Emphasizes framework selection and reconciling overlapping control requirements across standards.
Data Breach and Privacy Incident Response
Responding to privacy incidents and breaches: detection, containment, investigation, severity and breach classification, and regulator and individual notification within statutory deadlines. Covers complaint intake and resolution, escalation, and balancing transparency against risk during an incident. Includes coordinating the cross-functional response and post-incident remediation.
GDPR Principles and Compliance
The General Data Protection Regulation in depth: the six lawful bases, data subject rights, accountability and records obligations, DPO requirements, and enforcement and fines. Covers how GDPR principles translate into concrete engineering and product controls. Includes controller and processor obligations and demonstrating compliance.
Communicating Security and Privacy Risk to Stakeholders and Leadership
Translating technical security, compliance, and privacy risk into language that executives, boards, and non-technical stakeholders can act on. Covers framing risk in business terms, influencing leadership on investment and strategy, tailoring the message to the audience, and driving decisions through communication. The persuasion-and-translation skill, distinct from the metrics themselves.
Security Ethics and Responsible Disclosure
Ethical and legal boundaries in security work and the norms of responsible vulnerability disclosure. Covers coordinated disclosure and bug-bounty conduct, staying within legal and ethical limits during testing, handling conflicts of interest, and ethical decision making under pressure. Especially relevant where offensive testing meets legal and ethical constraints.
Privacy in Emerging Technologies
Privacy challenges raised by newer technologies and business models: AI and machine learning, biometrics, IoT, and other data-intensive innovations, plus how regulators are responding. Covers anticipating future privacy risks and adapting practices ahead of formal rules. Includes reasoning about privacy in novel data uses where guidance is still forming.
Data Minimization and Retention
Collecting and keeping only what is necessary: data minimization at collection, purpose limitation, and retention scheduling with automated deletion. Covers defining retention periods, enforcing them technically, and defensibly disposing of data. Includes balancing operational or analytics needs against minimization obligations.
Privacy-Enhancing Technologies and Anonymization
Technical safeguards that reduce identifiability: anonymization, pseudonymization, tokenization, differential privacy, and related privacy-enhancing technologies. Covers the difference between anonymized and pseudonymized data, re-identification risk, and when each technique is appropriate. Includes evaluating the privacy-utility tradeoff of a given technical control.
Cryptographic Standards and Compliance
Compliance and standards governing the use of cryptography: approved algorithms and key lengths, FIPS 140 validation, key management standards, and regulatory expectations for encryption of data at rest and in transit. Covers how cryptographic choices are constrained by standards and how to demonstrate cryptographic compliance. Standards-and-governance view of crypto, not cryptographic design or attacks.