Laws, Regulations, and Industry Standards are the externally imposed legal obligations, governmental mandates, and consensus-based technical frameworks that define the minimum acceptable governance and security posture for an organization's IT systems. Laws (e.g., HIPAA, SOX, GDPR) are enacted by legislative bodies and carry legal penalties for non-compliance. Regulations are implementing rules issued by agencies with enforcement authority (e.g., SEC cybersecurity disclosure rules, HHS HIPAA enforcement). Industry standards (e.g., ISO/IEC 27001, PCI DSS, NIST CSF, SOC 2) are consensus-based frameworks that may be voluntary or contractually mandated, but increasingly carry de facto legal weight through regulatory incorporation or customer contract requirements. For a CISA professional, mastery of this landscape means knowing which external obligations apply to a given organization, how they interact, and how internal governance structures must reflect them.
Where it stops · what it isn't
- —IS: Externally imposed legal, regulatory, and consensus-based obligations that shape IT governance, audit scope, and control design
- —IS: The mapping function between external requirements and internal policies, controls, and audit evidence
- —IS: The risk-prioritization discipline of determining which regulatory gaps create the greatest financial, legal, and reputational exposure
- —IS NOT: Internal policies, standards, or procedures — those are outputs shaped by external requirements and are covered in the IT Policies cubelet
- —IS NOT: Technical security controls themselves (e.g., firewall rules, encryption algorithms) — those are the implementation layer beneath governance
- —IS NOT: A static checklist — the regulatory landscape evolves continuously; this competency includes monitoring and adaptation, not enumeration alone
- —IS NOT: Comprehensive enumeration of every sector-specific regulation globally — the competency is 'identify what applies and assess compliance posture,' not memorization of all rules
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
REQUIRESIT Governance Structures and Organizational ModelsIT Policies, Standards, Procedures, and Guidelines
ENABLESIT Risk Management and Risk AssessmentIT Audit Planning and Scope DefinitionThird-Party Vendor Risk ManagementBoard-Level Cybersecurity Governance Reporting
PART OFCISA Domain 2: Governance and Management of IT
RELATED TOIT Strategy and Organizational Alignment
CONSTRAINSControl Design and Implementation