In 2022 a federal jury convicted Uber's former chief security officer of obstructing a Federal Trade Commission investigation and concealing a felony. The case centered on a 2016 breach that was handled as a bug bounty payout while the FTC was already examining the company's security. For security leaders the lesson was plain: compliance obligations attach to people as well as companies, and mishandling them can follow you personally.
On the CompTIA Security+ SY0-801 exam, compliance sits under objective 5.4, which expects you to summarize what makes a security compliance program effective. This lesson covers compliance training, including the anti-money laundering and anti-bribery topics that surprise many security students, the acknowledgements and attestations that prove a program is running, and the consequences when it isn't. Privacy rights and legal duties such as legal holds are covered in the next lesson.
Compliance means meeting your obligations and being able to prove it
Compliance is conformance with requirements that come from outside the security team's own preferences: laws and regulations such as GDPR, HIPAA, SOX and GLBA; contracts and industry standards such as PCI DSS, which card brands impose through merchant agreements; and the organization's own policies. Security compliance is the part of that work concerned with security controls.
A compliance program has two halves. One is doing what the requirements say. The other is proving it to someone else, whether an auditor, a regulator, a customer or the board, with evidence that stands up to inspection. A control that runs but leaves no record is, for compliance purposes, a control nobody can show was running.
The usual elements are an owner for the program, such as a compliance officer or a data protection officer where the law requires one; an inventory of obligations mapped to the controls that meet them; training; monitoring; reporting to leadership and, where required, to regulators; and a process for handling exceptions and violations.
Compliance is not the same as security. Requirements are minimums, and audits test samples, so a fully compliant organization can still be breached. But non-compliance is a risk in its own right, and its consequences can exceed the cost of the breach that exposed it.
Compliance training is tailored to the obligations each role carries
General security awareness training for all staff is covered in the security awareness section. Compliance training is narrower: it teaches people the specific legal and contractual duties their role carries. Some rules require it outright. PCI DSS requires security awareness training when a person is hired and at least once every 12 months, HIPAA requires a security awareness and training program for the workforce, and GDPR lists staff training among the data protection officer's tasks.
Data handling training is the most widely needed. It turns the classification policy into daily behavior: how to recognize regulated data such as cardholder data, health information and personal data; which storage locations and transfer methods are approved; why customer records don't go to personal email, unapproved file-sharing services or public AI tools; how long records are kept and how they are destroyed; and what to do, and how fast, when an email goes to the wrong recipient or a laptop goes missing.
The best data handling training is role-based. Call center agents who take card numbers by phone learn never to write them down. Developers learn not to copy production data into test environments. HR staff learn how employee medical and payroll records may be shared. Completion records matter as much as the content, because they are the evidence an auditor will ask for.