Compliance, contracts and investigation types

Laws are only part of the obligations a security program must meet. Contracts, industry standards and regulators' expectations add many more, and when something goes wrong the organization may face investigations of very different kinds. Sub-domain 1.4.6 of the CISSP outline covers contractual, legal, industry standards and regulatory requirements, and sub-domain 1.5 asks you to understand the requirements of administrative, criminal, civil, regulatory and industry standards investigations. This lesson treats compliance as a managed process and explains how investigation types differ in purpose, evidence standards and who is in charge.

Sources of obligation

An organization's security obligations come from several sources, and a compliance program must find and track all of them.

• Laws and regulations: statutes, regulations and binding regulator guidance, such as privacy laws, sector rules for banks, health providers and utilities, and critical infrastructure laws.
• Contracts: commitments made to customers, suppliers, partners and insurers, such as security schedules in service agreements, data processing agreements and cyber insurance policy conditions.
• Industry standards: requirements adopted by an industry, sometimes enforced through contracts, such as PCI DSS for card payments.
• Internal commitments: the organization's own policies, public privacy notices and statements to investors, which regulators may enforce if they are misleading.

Compliance is not the same as security. An organization can pass an audit and still be breached, because audits test against a standard at a point in time, and standards cannot anticipate every threat. Equally, a strong security program may fail an audit because it cannot produce evidence. The goal is a risk-based program that also produces the evidence compliance requires.

Regulatory obligations for critical sectors

In the United States, sector regulators set many cyber obligations: the federal banking agencies require notice of significant computer-security incidents within 36 hours; the New York Department of Financial Services Cybersecurity Regulation (23 NYCRR 500), amended in 2023, sets detailed program, governance and 72-hour reporting rules for financial firms it licenses; the Transportation Security Administration issues security directives for pipelines and rail; and NERC Critical Infrastructure Protection standards are mandatory for the bulk electric system. The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) will require covered entities to report covered cyber incidents to CISA within 72 hours and ransom payments within 24 hours once CISA's final rule takes effect; CISA missed its statutory deadline and signaled a final rule around September 2026, so check whether it has been published.

Managing compliance

A mature compliance program typically follows a cycle. First, maintain an obligations register that lists each requirement, its source, the business units affected and an owner. Second, map each obligation to controls, ideally in a common control framework so that one control satisfies several requirements. Third, implement and operate the controls. Fourth, gather evidence: policies, configuration records, logs, training records and test results. Fifth, assess compliance through self-assessment, internal audit and external audit. Sixth, report gaps and remediation to leadership and track them to closure.

Audits come in several forms. A first-party audit is an internal self-assessment; a second-party audit is performed by a customer or partner on its supplier; a third-party audit is performed by an independent body, such as a certification audit or a SOC report. Service organization control (SOC) reports are common evidence for service providers: SOC 1 covers controls relevant to customers' financial reporting, SOC 2 covers the trust services criteria (security, availability, processing integrity, confidentiality and privacy), and SOC 3 is a short public version of SOC 2. A Type I report describes controls at a point in time; a Type II report also tests their operating effectiveness over a period, usually six to twelve months.

In the United States, SOC reports are issued under the AICPA's attestation standards, with SOC 1 under SSAE 18 and SOC 2 against the AICPA trust services criteria. Federal agencies rely instead on FedRAMP authorizations for cloud services and on assessments under NIST SP 800-53A.

Contracts and service agreements

Contracts turn security expectations into enforceable obligations. Important security clauses include the right to audit or receive audit reports, data protection and confidentiality terms, breach notification timelines, data location and return or destruction at end of contract, subcontracting limits, liability and indemnity, insurance, and service levels. A service level agreement (SLA) specifies measurable commitments such as 99.9 percent availability or a four-hour response to severity-one incidents, and the remedies, usually service credits, if they are missed. A memorandum of understanding (MOU) records an agreement that is often not legally binding, and an interconnection security agreement documents the security terms for connecting two organizations' systems.

Investigation types

When an incident or allegation arises, the organization must decide what kind of investigation is under way, because that determines who leads it, what evidence standard applies and how evidence must be handled. The outline lists five types.

An investigation can change type. An internal investigation into an employee copying files may uncover evidence of fraud that becomes a criminal matter, or a customer may bring a civil claim. For that reason, a safe default is to handle evidence as if it might end up in court: preserve it promptly, document the chain of custody, work on forensic copies rather than originals and involve legal counsel early. Counsel can also help protect sensitive findings under solicitor-client or attorney-client privilege.

Evidence in legal proceedings must generally be relevant, reliable and properly obtained. Digital evidence is fragile and easily changed, so investigators collect it in order of volatility (memory before disk, for example), record hash values to show it has not been altered, and keep a chain of custody record showing who handled it, when and why. Domain 7 covers forensic procedures in depth. Organizations also have a duty to preserve relevant information once litigation is reasonably anticipated, often called a legal hold; destroying it can bring serious sanctions.

In the United States, electronic evidence is governed by the Federal Rules of Evidence and Federal Rules of Civil Procedure, which include specific rules on electronically stored information and sanctions for failing to preserve it. Searches by government agents must respect the Fourth Amendment; private employers investigating their own systems are not bound by it in the same way, but must follow privacy and labor laws, and courts have required warrants for cell phone searches (Riley v. California, 2014).

Building an evidence culture

Organizations that handle audits and investigations well usually share a habit: they generate evidence as a by-product of normal work rather than scrambling to recreate it. Change tickets record who approved each change; access reviews are signed off in a tool that keeps history; logs are retained according to a schedule that matches legal and investigative needs; training completion is tracked automatically. When an auditor or regulator asks for proof, the evidence already exists and can be produced quickly.

Log retention deserves particular attention. Too little retention leaves investigators blind when a breach is discovered months after it began, which is common. Too much retention increases storage costs and privacy risk, because logs often contain personal information. A sound approach sets retention periods by log type based on legal requirements, investigative needs and privacy principles, protects logs against tampering, and synchronizes time sources so that events from different systems can be correlated. Investigators also need clear authority: policies should state that the organization may access and review its systems and data for legitimate purposes, which supports lawful internal investigations and sets employees' expectations.

Finally, compliance work should be proportionate. Small organizations can meet many obligations with a modest set of well-run controls and good records, while large regulated firms may need dedicated compliance teams, governance, risk and compliance software, and continuous control monitoring. In every case, the aim is the same: know your obligations, meet them through controls that also reduce real risk, and be able to prove it.

Good evidence habits also make the organization faster and more confident when something goes wrong, because the facts needed for decisions are already recorded.