TechKnowSurge
CompTIA Security+ 5.4 ISC2 CISSP 1.4 CompTIA Security+ 5.1
TechKnowSurge Catalog Interactives What Pulled Them In?
InteractiveSecurityFree

What Pulled Them In?

A new market, a new service, a new kind of customer: name the regime each change brings into play.

⚑ Complete this interactive to capture a CTF flag worth 5 points.

About this interactive

The lesson's question is what decides which laws, regulations and standards an organization has to meet. Its answer is a set of factors, each with an example. Geographical location: where the organization operates, and also where its customers are and where their data is collected or stored. GDPR applies to an organization that offers goods or services to people in the EU, or monitors their behavior, or has an office there, wherever its headquarters are. Industry: the Gramm-Leach-Bliley Act (GLBA) applies to financial institutions, the businesses that offer financial products such as loans, accounts or insurance. A retailer that starts lending moves into that industry. Services offered: the Payment Card Industry Data Security Standard (PCI DSS) applies to anyone that stores, processes or transmits card data, so taking card payments brings it in. It is set by the card industry, not by a law. Customers targeted: the Children's Online Privacy Protection Act (COPPA) applies to websites and online services aimed at children under 13, or that know they collect data from them. Data collected: the lesson pairs HIPAA (the Health Insurance Portability and Accountability Act) with health information. Strictly, HIPAA covers health information held by health care providers, health plans and the businesses that handle it for them; a fitness gadget company holding heart-rate data is not covered by HIPAA. Every HIPAA card here is one of those. To sort a card, ask what changed: where the customers are, what industry the business is now in, what service it now offers, who it now targets, or what health information it now holds for a provider.

What you'll learn

Aligned to

CompTIA Security+
5.4 Summarize elements of effective security compliance.
5.1 Summarize elements of effective security governance.
ISC2 CISSP
1.4 Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context

Key terms

General Data Protection Regulation
GDPR
A European Union regulation that establishes comprehensive data protection and privacy rights for individuals within the EU and EEA, and imposes obligations on organizations that process EU residents' personal data regardless of where the organization is located. GDPR introduced concepts such as data minimization, the right to erasure, and mandatory breach notification.
Health Insurance Portability and Accountability Act
HIPAA
A U.S. federal law that establishes national standards for protecting the privacy and security of patients' health information, known as Protected Health Information (PHI). HIPAA's Security Rule requires covered entities and business associates to implement administrative, physical, and technical safeguards for electronic PHI.
Payment Card Industry Data Security Standard
PCI DSS
A set of security requirements mandated by major credit card brands that organizations must follow to process, store, or transmit cardholder data. PCI DSS covers controls such as encryption, access restriction, and regular security testing.
Gramm-Leach-Bliley Act
GLBA
A U.S. federal law that requires financial institutions to explain how they share and protect customers' private financial information, and to implement security programs to safeguard that data. The GLBA Safeguards Rule mandates specific information security controls for financial institutions.
Regulatory Compliance
The adherence to laws, government regulations, and industry standards that mandate how an organization must protect data and systems. Failure to meet regulatory requirements can result in fines, legal liability, and reputational damage.

Topics

Compliance Regulatory Compliance Compliance Factors Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →