Security Governance, Risk & Privacy Topics
Governance, compliance frameworks, regulatory requirements, compliance implementation, and compliance-driven risk management. Covers compliance frameworks (SOX, GDPR, HIPAA, FCPA, etc.), regulatory interpretation, compliance control design, audit and control effectiveness evaluation, and compliance process management. For operational security implementation and technical threat mitigation, see Security Engineering & Operations.
Health Data Privacy and HIPAA
Protecting health and medical data under HIPAA and equivalent sector rules: PHI, the Privacy and Security Rules, covered entities and business associates, and permitted uses and disclosures. Covers de-identification standards and safeguards specific to healthcare data. Includes how health-data constraints shape system and product design.
Compliance Frameworks and Certification Standards
The major security compliance frameworks and how to achieve and maintain certification against them: SOC 2, ISO 27001, NIST CSF, NIST 800-53, CIS Controls, PCI DSS, and FedRAMP. Covers what each framework governs, how control families map to organizational practices, and how to scope, prepare for, and pass a certification assessment. Emphasizes framework selection and reconciling overlapping control requirements across standards.
Privacy-Preserving Analytics and Experimentation
Doing measurement and data science without over-collecting or exposing individuals: privacy-preserving experiment design, aggregate and on-device measurement, and privacy-respecting attribution. Covers techniques for analytics and A/B testing that limit personal-data use and honor consent. Includes reconciling measurement quality with privacy constraints.
Research Ethics and Consent
Handling personal data in research responsibly: informed consent for studies, research ethics review, participant protection, and secondary-use limits. Covers designing user research and data-collection studies that respect participants and comply with privacy obligations. Includes balancing research value against participant privacy.
Security and Privacy Culture, Training and Awareness
Building organization-wide security and privacy awareness and a culture where protective behavior is the norm. Covers awareness and role-based training programs, phishing simulations, embedding security and privacy ownership into engineering, product, and support teams, and measuring and improving culture. Focuses on the human layer of the program rather than technical controls.
Data Breach and Privacy Incident Response
Responding to privacy incidents and breaches: detection, containment, investigation, severity and breach classification, and regulator and individual notification within statutory deadlines. Covers complaint intake and resolution, escalation, and balancing transparency against risk during an incident. Includes coordinating the cross-functional response and post-incident remediation.
Data Subject Rights and Request Handling
Operationalizing individual rights: access, rectification, erasure, portability, restriction, and objection requests. Covers identity verification, response timelines, locating data across systems to fulfill a request, and handling edge cases and exemptions. Includes designing systems that can execute deletion and export reliably at scale.
Cross-Border Data Transfers and Multi-Jurisdictional Compliance
Handling personal-data flows and compliance obligations that span multiple jurisdictions with conflicting or overlapping requirements. Covers adequacy decisions, standard contractual clauses, transfer impact assessments, data residency and localization constraints, and reconciling regional regulations into a control set that satisfies the strictest applicable rule while remaining operable globally. Includes emerging and regional privacy laws beyond the major frameworks and the complexity of operating under many regimes at once.
GDPR Principles and Compliance
The General Data Protection Regulation in depth: the six lawful bases, data subject rights, accountability and records obligations, DPO requirements, and enforcement and fines. Covers how GDPR principles translate into concrete engineering and product controls. Includes controller and processor obligations and demonstrating compliance.