Determine which obligations apply, distinguish legal duties from promises, and trace requirements to controls and evidence.
55 min 150 XPSkills: Applicability assessment, Obligations registers, Contract review
Brief
At fictional Larkspur Services, a scheduling platform processes patient bookings for clinics, manages its own employee records, and uses a hosted checkout for subscriptions. A sales lead calls every security requirement a law. An incident lead assumes that every notification can wait 72 hours. Meanwhile, a signed customer security addendum requires an initial incident notice within 24 hours of discovery.
As the analyst, identify the source and scope of each duty before assigning work. The same organization can have different roles for different processing activities, and one incident can trigger several independent duties. Your deliverable is a defensible obligations register, not a list of impressive acronyms.
Examples teach assessment methods, not jurisdiction-specific legal advice. Confirm current source text and obtain qualified legal interpretation for uncertain scope or conflicts.
Name the source before calling it mandatory
A law is a binding legal rule; in this comparison, legislation is a rule enacted by a legislature. A regulation is a binding instrument made under legal authority. Naming conventions vary: the GDPR is itself an EU regulation with legal force, not a voluntary privacy framework. Do not decide legal status from an informal document title or from whether a regulator published guidance about it.
A standard specifies requirements or criteria, such as ISO 27001 or PCI DSS. A framework such as NIST CSF organizes outcomes and risk-management activities. Standards and frameworks are not automatically laws, but legislation, regulatory rules, or contracts can incorporate their requirements. A contract binds parties to agreed commitments when enforceable; calling its security addendum optional does not undo a signature.
Suppose Larkspur has 12 chosen framework outcomes and 3 signed customer clauses requiring quarterly access reviews. The outcomes may be voluntary as selected, while the 3 clauses are contractual obligations. One quarterly review control might satisfy all 3 clauses, but preserve each source separately. An auditor asks which exact clauses make the review necessary, not whether the team has a framework poster.
Establish applicability, not acronym coverage
Scope starts with facts: legal entities, locations, people served, data categories, processing activities, services, and agreements. GDPR applicability can arise through an EU establishment or certain offering of goods or services to, or monitoring of, people in the EU; citizenship alone is not the test. HIPAA applies to covered entities and business associates in defined circumstances, not automatically to every app holding health-related data. A clinic's vendor may be a business associate when it handles protected health information on the clinic's behalf; assess the relationship and required agreement.
PCI DSS is a payment-card industry security standard, commonly imposed through payment ecosystem agreements, not itself a statute. Outsourcing checkout can reduce scope but does not automatically remove merchant responsibilities: verify integration, provider responsibilities, and applicable validation requirements. Sector obligations also differ: financial services, telecommunications, and healthcare may have additional jurisdiction-specific regulator rules, reporting duties, and retention requirements. A generic certification does not settle any of those scope questions.
Of 8 Larkspur services, 2 support clinic workflows and 1 accepts subscription payments. Those counts are investigation inputs, not proof that HIPAA applies to exactly 2 systems or PCI DSS to exactly 1. Shared administration and connected services can affect boundaries. Record each applicability decision, supporting facts, reviewer, date, and reassessment trigger. An auditor asks why an excluded service is out of scope and what changes would invalidate that conclusion; an unexplained 'not applicable' is weak evidence.
Assign roles for each processing purpose
Under GDPR, a controller determines the purposes and means of processing personal data; a processor processes personal data on behalf of a controller. A processor may choose some practical implementation details without becoming the controller for that service. Roles follow the real activity, not the company size, hosting location, or the word 'owner' in a spreadsheet. Joint determination can require analysis of joint controllership rather than forcing every relationship into a simple vendor label.
For clinic appointment records, assume the clinic determines why patients are scheduled and Larkspur follows documented instructions: the clinic is the controller and Larkspur the processor for that activity. For its own staff payroll purposes, Larkspur is a controller. A processing agreement should address instructions, confidentiality, security, subprocessors, assistance, return or deletion, and audit-related obligations as applicable under GDPR Article 28. Signing it does not transfer all statutory responsibility away from either party.
Draw one role map per activity. If Larkspur appoints another service to process clinic data on its behalf, assess subprocessor authorization and equivalent contractual duties. Ask who decides any new analytics purpose before reusing appointment data. An auditor can request the agreement, actual data flow, and evidence that operational instructions match it; a vendor inventory marked 'processor everywhere' is not enough.
Roles attach to processing activities, not permanently to an organization.
Run notification clocks in parallel
For a personal data breach under GDPR, a controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware, unless the breach is unlikely to result in a risk to people's rights and freedoms. A notification after 72 hours needs reasons for delay. A processor notifies its controller without undue delay after becoming aware; it does not receive a universal 72-hour waiting period. Controllers document breaches, including facts, effects, and remedial action, even when authority notification is not required.
Communication to affected people is a separate GDPR decision: where the breach is likely to result in high risk, communicate without undue delay unless an applicable exception applies. Initial facts may be incomplete; information can be provided in phases under the regulation's conditions. Distinguish detection of an alert from awareness of a personal data breach, record the assessment, and escalate promptly rather than delaying awareness administratively until an investigation closes.
In a controller example with a reportable breach, awareness at Monday 10:00 gives a 72-hour outer target of Thursday 10:00, not the end of Thursday; 'without undue delay' still matters. A separate contract requiring notice within 24 hours of discovery at Monday 09:00 gives Tuesday 09:00. HIPAA has different rules: for example, covered-entity individual notice for breaches of unsecured protected health information is without unreasonable delay and no later than 60 calendar days after discovery, subject to applicable provisions; business-associate and other notices have their own requirements. Never reuse one law's number for all recipients. Legal and incident teams should assess triggers, recipients, exceptions, and shorter applicable duties in parallel.
Translate customer promises into operating duties
A security addendum can require incident notices, encryption, access reviews, subprocessor approvals, deletion deadlines, audit assistance, or data-location restrictions. Read defined terms and order-of-precedence clauses: 'security incident' in a contract may cover more events than a statutory 'personal data breach.' A customer notice is not a substitute for a regulator report, and notifying one customer does not necessarily satisfy a notice owed to another.
Before signature, compare each promise with actual capability. A requirement to delete production records within 30 days may need separate treatment of backups, legal holds, and retention obligations. Do not silently promise immediate erasure of immutable backups. Identify exceptions and negotiate precise terms with authorized legal and commercial reviewers. Where duties appear to conflict, escalate for resolution; staff cannot simply select the easiest deadline or waive law through a contract.
For 6 customers with incident notice limits of 24, 24, 36, 48, 48, and 72 hours, a 24-hour internal response target may simplify operations but does not erase the 6 independent triggers, recipients, and records. Maintain an accessible contact route and test escalation outside business hours. An auditor asks for signed terms, the implemented procedure, and a timed exercise or actual notice record, not just a sales questionnaire claiming compliance.
Build and maintain the obligations register
A useful row records source and version or effective date, precise clause, applicable entity and activity, requirement, accountable owner, mapped control, and evidence location. Add deadline and trigger where relevant, applicability rationale, status, review date, and approved interpretation or exception references. Keep source text distinct from the team's operational translation. A requirement says what must be achieved; a control describes how the organization achieves it; evidence shows whether that control operated.
Worked row: source 'Customer Cedar addendum section 4, signed 3 May'; scope 'Cedar production scheduling'; requirement 'initial customer notice within 24 hours of discovery of a defined security incident'; owner 'Incident lead'; control 'on-call triage and customer escalation procedure IR-4'; evidence 'incident ticket timestamps and dispatch receipt.' For discovery Monday 09:00 and dispatch Monday 15:00, the elapsed time is 6 hours, leaving 18 hours before the contractual limit. A procedure alone cannot prove that a specific notice was sent.
One control may support many obligations, and one obligation may need multiple controls. Preserve links rather than duplicating documents or collapsing all sources into 'compliance.' Review on renewal, new jurisdictions, service changes, incidents, and source updates as well as periodically. An auditor samples backward from evidence to control and source, then forward from an applicable clause to delivery. Common failures are missing owners, obsolete clauses, unsupported exclusions, and evidence that describes a different period or service.
Trace obligations to operation and revisit scope when facts or sources change.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The law that came from procurement
Scenario sim+50 XP
Use the facts, not the document labels, to answer both questions.
Incident brief
A sales lead calls PCI DSS a statute because the payment agreement requires it. Another lead labels a signed security addendum a voluntary framework, although its quarterly access-review clause binds the parties. Neither claim changes the origin of the requirement.
Term bank, not all of these are right
standardcontractlawframework
1.1What kind of instrument is PCI DSS itself? (one word)
1.2What kind of instrument makes the signed customer addendum binding between the parties? (one word)
Task 2: The vendor with two hats
Scenario sim+50 XP
Assign GDPR roles for the named processing activity.
Incident brief
A clinic decides the purpose and essential means of appointment processing. Larkspur processes those records only on the clinic's instructions. A manager calls Larkspur the controller because it runs the servers and says the clinic is a processor because it enters the records. Larkspur's unrelated payroll processing is not part of this question.
Term bank, not all of these are right
controllerprocessorregulatorsubprocessor
2.1What is the clinic's role for appointment processing? (one word)
2.2What is Larkspur's role for that same processing? (one word)
Task 3: The universal seventy-two-hour rule
Scenario sim+50 XP
Identify the governing source and the missing evidence.
Incident brief
Larkspur discovers an incident at Monday 09:00. Its signed customer addendum requires initial notice within 24 hours of discovery. An analyst proposes waiting 72 hours because 'GDPR grants everyone three days.' The register links the addendum to an escalation procedure but contains no record that the procedure operated for this incident.
Term bank, not all of these are right
contractevidenceregulationcontrol
3.1Which source creates the stated 24-hour customer duty? (one word)
3.2Which register element is missing when there is no incident-specific proof of operation? (one word)
Labs
80 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
Assess six independent claims against the facts given. Reject each flawed claim using its closest reason code; accept the two supported claims.
The baseline requires correct source classification, justified scope, parallel notification assessment, and evidence of operation rather than policy alone.
Verdicts are accept or reject. Every rejection needs one reason code from: source-confusion | unsupported-scope | deadline-confusion | missing-evidence.
Independent register review claims
OB-1 | An analyst classifies PCI DSS itself as a statute solely because a payment agreement requires compliance.
OB-2 | A merchant declares all payment responsibilities out of scope solely because checkout is outsourced; no integration or responsibility review exists.
OB-3 | A signed addendum requires notice within 24 hours of discovery. The lead waits 72 hours solely because GDPR supposedly allows that for every recipient.
OB-4 | A row claims timely customer notice occurred. Its only support is an escalation policy, with no incident-specific delivery record.
OB-5 | For appointment processing, the clinic determines purposes and essential means; the vendor acts only on instructions. The reviewed role map labels clinic controller and vendor processor.
OB-6 | A scoped contract row links section 4, its 24-hour discovery trigger, incident lead, and IR-4 to a timestamped receipt showing notice 6 hours after discovery. This supports the claim of timely contractual notice only.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · GRC Fundamentals
Security Operations Basics for GRC
Trace access, changes, vulnerabilities, incidents, and monitoring from operational decisions to defensible audit evidence.
