Compliance & Frameworks
What the standards actually require, why compliant is not the same as secure, and how engineers meet both.
Compliant Is Not Secure
The inverse is also true and worth saying: frameworks encode decades of hard-won practice. An organisation genuinely implementing one is meaningfully better defended than one improvising, and the discipline of writing controls down is itself valuable.
The engineer's job is to meet the requirement in a way that also reduces risk, rather than producing a document that satisfies an auditor and changes nothing.
The Frameworks You Will Meet
| Framework | Scope | Driven by |
|---|---|---|
| ISO 27001 | An information security management system | International certification, often customer-required |
| SOC 2 | Controls over security, availability and confidentiality | US enterprise customers — usually sales |
| NIST CSF | A voluntary framework: identify, protect, detect, respond, recover | Self-assessment and structure |
| PCI DSS | Anything touching cardholder data | Card schemes — mandatory, prescriptive |
| HIPAA | Protected health information in the US | Law |
| GDPR / UK GDPR | Personal data of people in the EU and UK | Law, with substantial fines |
Data Protection In Practice
GDPR is the one that reaches ordinary engineering work most often, and its practical obligations are concrete.
| Obligation | What it means in a system |
|---|---|
| Lawful basis | A stated reason for every category of data you hold |
| Data minimisation | Do not collect what you do not need — the cheapest control there is |
| Purpose limitation | Data collected for one purpose is not silently reused |
| Right of access and erasure | You must be able to find and delete one person across every store |
| Breach notification | 72 hours to notify the regulator once aware |
| Privacy by design | Considered at design time, not retrofitted |
Controls, Evidence & Audits
A control is a stated practice; evidence is proof it operated. Audits sample evidence, so anything manual and undocumented tends to fail even when the practice is real.
| Control | Evidence an auditor accepts |
|---|---|
| Access is reviewed quarterly | Dated review records with approvals |
| Changes are peer reviewed | Pull requests with approvals and a protected branch |
| Backups are restorable | Restore test results, not a backup schedule |
| Vulnerabilities are remediated in SLA | Ticket timestamps showing time to fix |
| Only authorised staff have production access | IAM exports and joiner-mover-leaver records |
What This Means For Engineers
| Do | Instead of |
|---|---|
| Automate the control | Documenting a manual process nobody follows |
| Log the evidence as a by-product | Assembling screenshots the week before the audit |
| Know your data flows | Discovering a copy of personal data during a subject access request |
| Treat findings as backlog items | A separate compliance spreadsheet nobody reads |
| Push back on controls that add no safety | Implementing something that only satisfies a checkbox |
The last one is legitimate and expected. Frameworks allow compensating controls — if a requirement does not fit your architecture, the answer is to propose an equivalent that achieves the same objective and document why, not to fake compliance with the letter of it.
Interview Questions
Why is compliant not the same as secure?
An audit samples evidence that controls existed during a period. It does not test them against a motivated adversary, which is why organisations pass audits and get breached in the same quarter.
ISO 27001 versus SOC 2?
ISO 27001 certifies an information security management system to an international standard; SOC 2 is an attestation report on controls, usually demanded by US enterprise customers. Both certify process rather than architecture.
What makes PCI DSS different?
It is prescriptive about segmentation, encryption and key management, and its scope shrinks dramatically if cardholder data never enters your systems at all.
Why is the right to erasure an architecture problem?
Personal data spreads into logs, analytics, warehouses, backups and indexes. Deleting one person across all of them is a project unless minimisation and data-flow mapping came first.
What evidence do auditors actually accept?
Artefacts produced by the system — pull request approvals, IAM exports, restore test results, ticket timestamps — rather than descriptions of a process.
What is a compensating control?
An alternative that meets the objective of a requirement your architecture cannot satisfy literally, documented with the reasoning. It is the honest route rather than faking the letter of the standard.