CY9: Standards, law and compliance
Policies, evidence and honest claims
🎯You'll be able to
Write short policies that match practice, collect evidence that controls work, and make security claims that are exactly true.
🏠The everyday picture
A school prospectus that says "qualified teachers in every class" must be able to show the certificates. Saying "the best school in India" without proof invites trouble.
📘What it really is
-
Policies say what the organisation does: access control, passwords, backups, incident response, acceptable use. Short policies that match real practice are better than long ones nobody follows.
-
Controls are what actually happens: the MFA setting, the backup job, the review meeting.
-
Evidence shows controls working over time: screenshots with dates, exported settings, tickets, review records, restore test results, and logs.
-
Internal audits check a sample of evidence before an outside auditor does.
- Honest claims:
- Say "ISO 27001 certified for [scope] by [body]" only if true, and keep it current.
- Say "a SOC 2 Type II report covering [period]", not "SOC 2 certified".
- Avoid "unhackable", "100% secure" or "bank-grade"; no system can promise those.
-
Say "not verified" where something hasn't been tested.
-
Questionnaires: answer exactly what's asked, with evidence, and don't round "planned" up to "done".
📝A worked example
Input: a customer questionnaire asks AarogyaDesk "Do you encrypt backups?" and "Are you ISO 27001 certified?".
Steps:
- Check evidence: the backup job's settings show encryption on, and last month's restore test record.
- Answer: "Yes, backups are encrypted (settings export and restore test attached)."
- Answer: "No. We follow an ISO 27001-aligned approach and plan to assess certification later." Not "Yes, compliant".
Expected output: two exact answers, each backed by evidence or a plain "no".
🌍Where it's used
- Enterprise sales depend on accurate questionnaire answers.
- Advertising and consumer protection rules apply to false security claims.
- Auditors sample evidence across the whole period.
📝Case scenario
A start-up's website called its app "unhackable, military-grade secure". After a minor bug report went public, journalists quoted the claim alongside it. Its next site said what it actually did: encryption, MFA, regular assessments, and a contact for reporting problems.
🖱️Try it
Rewrite these claims honestly: "100% secure", "ISO compliant", "SOC 2 certified". Success: each new claim could be backed by a specific piece of evidence.
⚠️Common mistakes
- Policies copied from templates. Sign: rules nobody follows. Fix: write what you actually do, then improve it.
- Evidence gathered the week before an audit. Sign: no records for most of the year. Fix: collect as you go.
- Rounding up. Sign: "yes" for something planned. Fix: say "planned" with a date.
🛠️For your project
The capstone notes end with a list of claims AarogyaDesk could truthfully make, each with its evidence.
✅Quick check
Why say "SOC 2 Type II report" instead of "SOC 2 certified"?
Show the answer
SOC 2 is an auditor's report, not a certificate.
What makes a security claim honest?
Show the answer
It's exactly true, states its scope and can be backed by evidence.