Field Journal

Governance, Risk & Compliance / Deep Dive

Regulatory Mandates & Private-Sector Assurance

Not every "compliance requirement" carries the same legal weight. Applicable laws and regulations carry government enforcement authority and may impose financial or criminal penalties. Private-sector mechanisms differ: ISO 27001 is a certifiable management-system standard, PCI DSS is a payment-card standard enforced primarily through payment-network relationships, and SOC 2 is a CPA attestation report. Confusing these categories leads to misjudging legal exposure and negotiating leverage.

Two paths from source of obligation to consequence. Government path: a legislature or regulator enacts a law that applies automatically once its jurisdiction, entity, activity, data-type and sector tests are met, enforced by regulator orders, statutory fines and sometimes criminal liability. Private-sector path: an industry body, payment network or the audit profession publishes a standard that binds only through a contract, payment-network rule, procurement requirement or certification condition, with business consequences rather than government penalties. A note records that a law can incorporate a standard by reference, as Nevada NRS 603A.215 does for PCI DSS.

Both paths can compel behavior; only one carries a government penalty on its own

Government Laws and Regulations

These requirements apply when their jurisdictional, sector, entity, activity, and data-scope tests are met:

Regulatory Law / Mandate Jurisdiction Statutory Scope Primary Legal Focus
EU DORA European Union Financial-Sector ICT Resilience Law Mandatory digital operational resilience, ICT risk management, and incident reporting for banks, insurers, investment firms, and their critical ICT third-party providers.
EU NIS2 Directive European Union — via national transposition Multi-Sector Critical Infrastructure Directive Requires member states to impose cybersecurity risk management and incident reporting on “essential” and “important” entities across energy, transport, health, digital infrastructure, and other designated sectors — broader in scope than DORA and not limited to financial services. As a directive it binds member states rather than applying directly, so the enforceable obligations and penalties are those of each national implementing law, and they differ between member states.
GDPR European Union / EEA Statutory Data Privacy Regulation Directly applicable rules governing personal data collection, lawful basis and consent, processing limits, and data subject rights.
CCPA, as amended by the CPRA California, United States Statutory Consumer Privacy Law Rights to know, delete, correct, and opt out of the sale or sharing of personal information, for businesses meeting the statute’s revenue or data-volume thresholds. Enforced by the California Privacy Protection Agency and the Attorney General.
HIPAA Security Rule United States (Federal) Statutory Healthcare Law Mandatory administrative, physical, and technical safeguards for protecting electronic Protected Health Information (ePHI).
Singapore PDPA Singapore Statutory Data Protection Act Mandatory rules for collecting, processing, storing, and protecting personal data in Singapore (enforced by PDPC).

Separately, the DOJ Evaluation of Corporate Compliance Programs (ECCP) is prosecutorial guidance, not a statute—it is the criteria US federal prosecutors use to judge whether a corporate compliance program (including cybersecurity) was adequate when deciding charges or penalties after an incident. It carries real enforcement weight but sits in a different legal category from the statutory laws above: no legislature passed it, and it applies through prosecutorial discretion rather than a private right of action.

Private-Sector Standards and Assurance

These mechanisms serve different purposes and do not bind every organization automatically. They may become obligatory through contracts, payment-network rules, procurement requirements, or incorporation into law:

Compliance Standard Focus & Scope Audit / Attestation Mechanism Primary Business Purpose
ISO/IEC 27001:2022 Enterprise Information Security Accredited Third-Party Certification Certifiable Information Security Management System (ISMS) proving enterprise security governance to partners.
ISO/IEC 27701:2025 Privacy Management Systems Accredited Third-Party PIMS Certification Certifiable Privacy Information Management System (PIMS) for PII controllers and processors; the 2025 edition replaced the withdrawn ISO/IEC 27701:2019 and can now be implemented and certified independently of an ISO 27001 ISMS rather than only as an extension to it.
NIST Privacy Framework Privacy Risk Management Voluntary self-assessment — no certification scheme exists A voluntary outcome framework for managing privacy risk, structured like NIST CSF. It is a planning and communication tool, not something an organization can be certified or attested against.
PCI-DSS v4.0.1 Payment Card Security Annual QSA Audit / Report on Compliance Contractual technical requirements for processing, storing, or transmitting credit card data—enforced by the payment card networks, not a government. Version 4.0.1 is the currently active revision, superseding 4.0.
SOC 2 Type II (AICPA) B2B SaaS & Cloud Security Independent CPA Audit Attestation Proving operational control effectiveness (Security, Availability, Confidentiality) to enterprise customers.

ISO/IEC 27701:2025 PIMS Control Mapping to Statutory Privacy Rules

The 2025 edition is structurally different from the withdrawn 2019 one, and the difference matters when reading any older mapping. ISO/IEC 27701:2019 carried its privacy guidance as numbered clauses — clause 7 for PII controllers, clause 8 for PII processors. ISO/IEC 27701:2025 adopts the Harmonized Structure, so clauses 4–10 are now the generic management-system clauses (Context, Leadership, Planning, Support, Operation, Performance evaluation, Improvement) and the privacy controls moved into a consolidated Annex A:

A 2019-style citation such as “clause 7.2.5” therefore does not resolve against the 2025 edition; clause 7 there is Support. Annex F of the 2025 standard carries the correspondence table in both directions, and is the authority to check a legacy mapping against.

Privacy Operational Domain ISO/IEC 27701:2025 Annex A control area GDPR Statutory Alignment CCPA / CPRA Statutory Alignment
Consent & Choice Management A.1.2 (conditions for collection and processing) — identify the lawful basis, and determine, obtain, and record consent where consent is the basis relied on. GDPR Article 6 & 7 (Lawfulness of processing & consent conditions). CCPA § 1798.120 (Right to opt-out of sale/sharing of personal info).
Data Minimisation & Purpose A.1.4 (privacy by design and privacy by default) — limit collection, limit processing, and set PII minimization objectives (A.1.4.5). GDPR Article 5(1)(b) & (c) (Purpose limitation & data minimisation). CCPA § 1798.100 (Notice at collection & collection limits).
Data Subject Access Rights A.1.3 (obligations to PII principals) — access, correction, erasure, portability, and handling of automated decision making (A.1.3.11). GDPR Articles 15–21 (Access, rectification, erasure “right to be forgotten”, portability). CCPA/CPRA §§ 1798.100, .105, .106, .110 (notice at collection; delete; correct; know).
Privacy Impact Assessment A.1.2.6 (privacy impact assessment), with processor and joint-controller responsibilities fixed by contract under A.1.2.7 and A.1.2.8. GDPR Article 25 & 35 (Data protection by design/default & DPIA). CPRA § 1798.185(a)(15) (Risk assessment & cybersecurity audit mandates).
Data Breach Notification A.3 (shared information security controls) — information security incident management, plus the processor’s duty to inform the controller. ISO/IEC 27701 sets no notification deadline of its own; the deadline comes from the applicable law. GDPR Article 33 & 34 (72-hour supervisory breach notification). CCPA § 1798.150 (Private right of action for data breaches).

The Annex A group headings above are stable; where an exact control number is needed for a Statement of Applicability, take it from the standard rather than from any secondary mapping, including this one.

Question Applicable Laws and Regulations Private-Sector Standards and Assurance
Who created it? A legislature or government regulator. An industry body, standards organization, or payment network consortium.
What compels compliance? Government enforcement action, statutory fines, potential criminal liability. A contract clause, a payment network rule, or a customer’s procurement requirement.
Can you opt out? No, if the law’s jurisdictional/subject-matter scope applies to you. The standard itself does not impose a government penalty, but a separate law can incorporate it by reference — for example, Nevada’s data security statute (NRS 603A.215) requires certain data collectors who accept payment cards to comply with PCI-DSS, turning what is nominally a voluntary industry standard into a state-law obligation for those businesses. Even without such incorporation, opting out is rarely free of consequence: the standard is frequently written into contracts, vendor agreements, or the eligibility criteria for a certification a counterparty requires — so declining still risks breach-of-contract exposure or losing the business relationship (e.g., a bank refusing to process cards without PCI-DSS, or a customer contract requiring an active SOC 2 report).
Applicability test Jurisdiction, entity, activity, data type, and sector define scope. The standard, assurance engagement, payment-network rule, contract, or procurement requirement defines scope.

A private-sector standard or assurance mechanism carrying no direct regulatory penalty of its own is not the same as it carrying no consequence, and “no direct penalty” is not a universal property of the category either: a state or national law can incorporate a standard directly, as Nevada’s NRS 603A.215 does for PCI DSS. Short of that direct incorporation, once a requirement is written into a contract, procurement policy, payment-network rule, or certification condition, non-compliance can trigger remedies, termination, loss of eligibility, or other business consequences.

What I need to remember

Applicable laws and regulations—such as GDPR, HIPAA, PDPA, DORA, and national laws implementing NIS2—carry government enforcement authority. ISO 27001 certification, PCI DSS compliance, and SOC 2 attestation arise through different private-sector mechanisms, though contracts or laws can incorporate them and create legal consequences.

Primary references