CY9: Standards, law and compliance
Frameworks, standards, laws and contracts
🎯You'll be able to
Tell apart frameworks, standards, laws and contracts, and use a framework to organise a security programme.
🏠The everyday picture
A driving instructor's checklist, the official driving test, the traffic law and a company's rules for its delivery drivers all cover safe driving, but each comes from a different place and carries different consequences.
📘What it really is
-
Frameworks organise good practice, and are usually voluntary. The NIST Cybersecurity Framework 2.0 (2024) groups outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. The CIS Controls give a prioritised list of safeguards.
-
Standards set requirements that can be audited, such as ISO/IEC 27001 (Lesson 2).
- Attestation reports such as SOC 2 give an auditor's opinion on controls (Lesson 3).
-
Laws are mandatory: in India, the Information Technology Act, 2000, CERT-In's directions, and the Digital Personal Data Protection Act, 2023 (Lesson 4). Sector regulators, such as the RBI for banks, add their own rules.
-
Contracts with customers can require any of these, plus breach notice periods and audit rights.
- One programme, many maps: a well-run set of controls can be mapped to several of these, so the same evidence serves many requests.
📝A worked example
Input: AarogyaDesk's controls from earlier modules.
Steps:
- Map them to the NIST CSF functions: asset list and threat model (Identify); MFA, lockouts, encoding, headers (Protect); the five detection rules (Detect); the incident playbook (Respond); backups and restore tests (Recover).
- Add Govern: who owns security at the clinic, and how risks are accepted.
- Note gaps, such as no supplier review.
Expected output: a one-page table of controls under six functions, with gaps marked.
🌍Where it's used
- Boards often see security reported by CSF function.
- Small companies start from the CIS Controls' first group of safeguards.
- Procurement teams ask which framework a supplier follows.
📝Case scenario
A start-up answered three customer questionnaires from scratch in one quarter, each taking a week. When it mapped its controls once to a framework and kept the evidence in one place, the fourth questionnaire took a day.
🖱️Try it
Take five security habits you already have (such as a phone lock or backups) and put each under one of the six CSF functions. Success: at least four functions have something in them.
⚠️Common mistakes
- Treating frameworks as law. Sign: "the law requires the CIS Controls". Fix: say which are voluntary and which are mandatory.
- One project per standard. Sign: separate controls for each audit. Fix: one set of controls, mapped many ways.
- Forgetting Govern. Sign: no owner for security. Fix: name who decides and who accepts risk.
🛠️For your project
The capstone design notes include a compliance section mapping AarogyaDesk's controls to the six CSF functions.
✅Quick check
Name the six functions of the NIST Cybersecurity Framework 2.0.
Show the answer
Govern, Identify, Protect, Detect, Respond and Recover.
What's the difference between a framework and a law?
Show the answer
A framework is usually voluntary guidance; a law is mandatory.