Security Governance, Risk & Privacy Topics
Governance, compliance frameworks, regulatory requirements, compliance implementation, and compliance-driven risk management. Covers compliance frameworks (SOX, GDPR, HIPAA, FCPA, etc.), regulatory interpretation, compliance control design, audit and control effectiveness evaluation, and compliance process management. For operational security implementation and technical threat mitigation, see Security Engineering & Operations.
Health Data Privacy and HIPAA
Protecting health and medical data under HIPAA and equivalent sector rules: PHI, the Privacy and Security Rules, covered entities and business associates, and permitted uses and disclosures. Covers de-identification standards and safeguards specific to healthcare data. Includes how health-data constraints shape system and product design.
Compliance Frameworks and Certification Standards
The major security compliance frameworks and certification standards and how to achieve and maintain them: SOC 2 (Type I and II, Trust Services Criteria), ISO/IEC 27001 and 27701, NIST CSF and SP 800-53, CIS Controls, PCI DSS (scoping, the cardholder data environment, segmentation and card-on-file architecture, staying compliant as software ships), and FedRAMP (baselines, authorization boundary and authorization paths). Covers what each framework governs, mandatory regulation versus voluntary standard (including regulated product standards versus a voluntary certification), prescriptive versus principles-based approaches, how control families map to organizational practices, choosing and sequencing frameworks and making the cost case, which framework mandates versus merely expects a practice such as penetration testing, reading vendor attestations, scoping and gap analysis including which gaps block certification, certification roadmaps, sustaining compliance after the first report, and harmonizing overlapping requirements across standards and laws into one traceable control set. Excludes designing and testing individual controls, building audit evidence packages, compliance tooling, and the detailed text of privacy laws, which are covered elsewhere.
Security and Privacy Culture, Training and Awareness
Building organization-wide security and privacy awareness and a culture where protective behavior is the norm. Covers awareness and role-based training programs, phishing simulations, embedding security and privacy ownership into engineering, product, and support teams, and measuring and improving culture. Focuses on the human layer of the program rather than technical controls.
Data Breach and Privacy Incident Response
Responding to privacy incidents and breaches: detection, containment, investigation, severity and breach classification, and regulator and individual notification within statutory deadlines. Covers complaint intake and resolution, escalation, and balancing transparency against risk during an incident. Includes coordinating the cross-functional response and post-incident remediation.
Compliance Investigation and Legal Collaboration
Investigating suspected compliance violations and coordinating with legal, security, and law enforcement. Covers compliance investigation methodology, evidence handling and chain of custody for compliance matters, escalation and disciplinary decision making, and working with legal counsel and external authorities. The investigate-and-enforce side of a compliance function.
GDPR Principles and Compliance
The General Data Protection Regulation in depth: the six lawful bases, data subject rights, accountability and records obligations, DPO requirements, and enforcement and fines. Covers how GDPR principles translate into concrete engineering and product controls. Includes controller and processor obligations and demonstrating compliance.
Internal Controls Design and Effectiveness Testing
How to design controls and prove they work. Covers control objectives, preventive vs detective vs corrective vs compensating controls and what makes a compensating control legitimate, building and maintaining a control matrix that maps controls to risks, owners and requirements, control ownership and segregation of duties, the COSO internal control framework, entity-level vs process-level controls, the three lines of defence, design-effectiveness vs operating-effectiveness testing, choosing test methods, test cadence and re-tests, sampling and interpreting exceptions, control self-assessment, judging whether controls are improving or decaying over time, evaluating control deficiencies and their severity, reliance on IT general controls, retiring, consolidating or automating controls without losing coverage, control changes in a cloud migration, and corrective and preventive action when a control fails. Applies to security, IT and compliance controls, including the IT general controls that support financial reporting, at the level of the control discipline itself. Excludes finance-process controls (payables, reconciliations, month-end close), the technical mechanics of any one security tool or attack technique, the content of specific certification frameworks, audit logistics and evidence handling, and compliance tooling and automation.
Security, Privacy and Compliance Risk Assessment
Identifying, analyzing, prioritizing, and treating information-security, compliance, and privacy risk. Covers qualitative and quantitative assessment methodologies, including expected-loss models and sensitivity to assumptions, scoping a first assessment of a new application or data platform, asset identification and valuation, threat and vulnerability identification, likelihood and impact (and severity-of-harm) scoring, risk registers, risk appetite and tolerance, residual risk, and treatment decisions (accept, mitigate, transfer, avoid), including cyber insurance as risk transfer and formal risk acceptance. Includes privacy-specific assessments such as DPIAs and PIAs: when one is required, how to structure it, and how to weigh likelihood and severity of harm to individuals, plus dataset privacy risk scoring. Also covers turning technical findings into business risk, quantifying reputational impact, compliance risk in a new market, risk-based prioritization under budget limits, lightweight assessment gates in delivery, and ongoing risk monitoring. Emphasizes structured, repeatable methodology tied to business context. Service reliability and operational risk, disaster recovery, incident handling, vendor selection and third-party risk, technical attack analysis, presenting risk to executives, governance decision rights, compliance tooling, audit preparation, and vulnerability scanner triage are covered elsewhere.
Security Findings Management and Remediation Tracking
Managing the lifecycle of security and compliance findings from identification through closure. Covers triaging and prioritizing findings and large backlogs by business impact, assigning ownership, designing tracker states and remediation ticket workflows with SLAs, escalation and time-bound risk-accepted exceptions, tracking remediation to completion, verifying fixes and choosing a retest approach, ingesting, deduplicating and normalizing findings across scanners and manual tests, and turning post-incident and vendor-blocked issues into tracked, prioritized remediation plans. Also covers reporting on remediation status, aging and program metrics (and how those metrics get misread), building auditor-ready evidence and mapping findings to compliance controls, scripting and querying remediation data, and writing the findings report itself: structure for developer and executive audiences, reproducible evidence, remediation guidance and safe handling of exploit proof. Discovering vulnerabilities and scoring them are out of scope.