Security Governance, Risk & Privacy Topics
Governance, compliance frameworks, regulatory requirements, compliance implementation, and compliance-driven risk management. Covers compliance frameworks (SOX, GDPR, HIPAA, FCPA, etc.), regulatory interpretation, compliance control design, audit and control effectiveness evaluation, and compliance process management. For operational security implementation and technical threat mitigation, see Security Engineering & Operations.
Audit Readiness, Evidence and Inspection Management
Being audited or inspected: preparing for internal and external audits and regulatory inspections, assembling and presenting the evidence auditors request (artifact packs, configuration snapshots, access records, change-approval and segregation-of-duties records, lineage and reproducibility records, design-decision and requirement traceability, and documentation packages a reviewer can follow), scoping evidence collection under deadline pressure, sampling and sample populations an auditor can trust, showing a control operated across a whole audit period rather than on one day, maintaining continuous audit readiness and audit-trail integrity, coordinating fieldwork, responding to auditor and regulator requests, including audits of deployed models (training data provenance, fairness testing records, third-party components you cannot inspect), disclosing evidence gaps and retention limits honestly, and handling adverse findings, disputed severity ratings and compensating controls professionally. Audit logging is covered as an evidence-strategy question (what must be provable, tamper-evident and retained, including where retention conflicts with privacy), not as log-pipeline engineering. Control design and testing of effectiveness, compliance frameworks and certification standards, compliance automation tooling, and detection-focused log engineering are covered elsewhere.
Third-Party, Vendor and Supply Chain Risk
Assessing and governing the security and privacy risk introduced by vendors, processors, sub-processors, and the broader supply chain. Covers vendor risk assessment and due diligence, data processing agreements and contractual security and privacy requirements, ongoing third-party monitoring, procurement compliance, and fourth-party risk. The 'trust but verify your dependencies' discipline across both security and data-protection obligations.
Health Data Privacy and HIPAA
Protecting health and medical data under HIPAA and equivalent sector rules: PHI, the Privacy and Security Rules, covered entities and business associates, and permitted uses and disclosures. Covers de-identification standards and safeguards specific to healthcare data. Includes how health-data constraints shape system and product design.
Compliance Frameworks and Certification Standards
The major security compliance frameworks and certification standards and how to achieve and maintain them: SOC 2 (Type I and II, Trust Services Criteria), ISO/IEC 27001 and 27701, NIST CSF and SP 800-53, CIS Controls, PCI DSS (scoping, the cardholder data environment, segmentation and card-on-file architecture, staying compliant as software ships), and FedRAMP (baselines, authorization boundary and authorization paths). Covers what each framework governs, mandatory regulation versus voluntary standard (including regulated product standards versus a voluntary certification), prescriptive versus principles-based approaches, how control families map to organizational practices, choosing and sequencing frameworks and making the cost case, which framework mandates versus merely expects a practice such as penetration testing, reading vendor attestations, scoping and gap analysis including which gaps block certification, certification roadmaps, sustaining compliance after the first report, and harmonizing overlapping requirements across standards and laws into one traceable control set. Excludes designing and testing individual controls, building audit evidence packages, compliance tooling, and the detailed text of privacy laws, which are covered elsewhere.
Privacy-Preserving Analytics and Experimentation
Doing measurement and data science without over-collecting or exposing individuals: privacy-preserving experiment design, aggregate and on-device measurement, and privacy-respecting attribution. Covers techniques for analytics and A/B testing that limit personal-data use and honor consent. Includes reconciling measurement quality with privacy constraints.
Research Ethics and Consent
Handling personal data in research responsibly: informed consent for studies, research ethics review, participant protection, and secondary-use limits. Covers designing user research and data-collection studies that respect participants and comply with privacy obligations. Includes balancing research value against participant privacy.
Security and Privacy Culture, Training and Awareness
Building organization-wide security and privacy awareness and a culture where protective behavior is the norm. Covers awareness and role-based training programs, phishing simulations, embedding security and privacy ownership into engineering, product, and support teams, and measuring and improving culture. Focuses on the human layer of the program rather than technical controls.
Data Breach and Privacy Incident Response
Responding to privacy incidents and breaches: detection, containment, investigation, severity and breach classification, and regulator and individual notification within statutory deadlines. Covers complaint intake and resolution, escalation, and balancing transparency against risk during an incident. Includes coordinating the cross-functional response and post-incident remediation.
Data Subject Rights and Request Handling
Operationalizing individual rights: access, rectification, erasure, portability, restriction, and objection requests. Covers identity verification, response timelines, locating data across systems to fulfill a request, and handling edge cases and exemptions. Includes designing systems that can execute deletion and export reliably at scale.