SY0-701 · Objective 5.4 · Security Program Management and Oversight
5.4 Security compliance explained
The official objective: “Summarize elements of effective security compliance.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 5.4 covers
Objective 5.4 is about meeting the rules an organisation is bound by, showing that it does, and handling personal data properly.
Compliance reporting can be internal, such as a CISO reporting policy compliance and open exceptions to the board, or external, such as reports to a regulator. Compliance monitoring checks continuously that controls are working. It involves due diligence and due care (knowing the requirements and acting on them), attestation and acknowledgement (people confirming they have read and understood policies), internal and external checks, and automation that flags non-compliant resources as they appear.
The consequences of non-compliance are listed explicitly: fines, sanctions, reputational damage, loss of licence and contractual impacts. A payment processor that fails required examinations can lose the licence it needs to operate. A retailer that fails PCI DSS can face fines under its merchant agreement. Customers leaving after a breach is reputational damage, even without a fine.
Privacy is the largest part of the objective. Legal implications can be local or regional, national or global, and organisations operating in many places must follow all of them. The data subject is the person the data is about. The controller decides why and how personal data is processed. The processor handles it only on the controller's instructions. Ownership establishes who is accountable for a data set.
Data inventory and retention go together. An organisation can't protect or delete personal data it hasn't found, so the first step is to catalogue every system that holds it, what it holds and why. Retention rules then say how long each type is kept and when it must be destroyed.
The right to be forgotten lets an individual ask for their personal data to be erased. To respond, an organisation needs a process to verify the requester, find their data across systems and delete it, unless a legal duty requires it to be kept.
On the exam, compliance questions are usually about matching: which consequence fits the story, which role a party plays, or what an organisation needs in place to meet a privacy request. Keep the controller and processor straight, and remember that a data inventory comes before almost every other privacy control.
What candidates mix up
- Controller versus processor: the controller decides purpose and means; the processor follows instructions.
- Data subject versus data owner: the subject is the person the data describes; the owner is the person in the organisation accountable for it.
- Internal versus external reporting: internal goes to management or the board; external goes to regulators or other outside parties.
- Reputational damage needs no regulator; fines and licence loss do.
Practice questions for 5.4
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
Under data-protection regulations like the GDPR, an organization that determines the purposes and means of processing personal data is the __, while a company that processes that data on the first organization's behalf is the __.
- Adata controller; data processor
- Bdata processor; data controller
- Cdata custodian; data owner
- Ddata subject; data protection officer
Show answer and explanation
Answer: A) data controller; data processor
- AThe controller decides why and how personal data is processed and carries primary accountability; the processor acts only on the controller's documented instructions (e.g. a cloud/SaaS vendor).
- BThe roles are reversed — the one deciding purpose and means is the controller.
- CCustodian/owner are internal data-governance roles; controller/processor are the regulatory terms for this relationship between organizations.
- DThe data subject is the individual the data is about; the DPO oversees compliance. Neither fits the processing relationship described.
Question 2
An internal audit finds that a regional bank has not met a regulatory requirement for protecting customer data. Which consequence of non-compliance could the bank realistically face?
- AFines or other sanctions imposed by the regulator that supervises the bank
- BTransfer of its legal accountability for the data to its cloud service provider
- CExemption from external audits until the control gap is fully remediated
- DAutomatic acceptance of the gap as residual risk within its risk appetite
Show answer and explanation
Answer: A) Fines or other sanctions imposed by the regulator that supervises the bank
Failing to meet a regulatory requirement can lead to fines and sanctions, along with reputational and contractual consequences. Accountability cannot be passed to a provider, avoided through audit exemptions, or removed by accepting the risk.
- ACorrect. Regulators can impose fines and other sanctions for non-compliance. For example, GDPR fines can reach €20 million or 4% of annual global turnover, whichever is greater. Other consequences can include reputational damage, contractual impacts and, in serious cases, loss of a license to operate.
- BIncorrect. Under shared responsibility and data protection law, the organization that controls the data stays accountable for compliance. A cloud provider acting as a processor helps with compliance but does not take on the controller's obligations.
- CIncorrect. Non-compliance usually brings more regulatory scrutiny, such as follow-up examinations or required remediation. It does not create an exemption from audits.
- DIncorrect. Risk acceptance is a deliberate, documented management decision. It is not an automatic result of a finding, and an organization cannot accept its way out of a legal or regulatory obligation.
Question 3
Under a privacy regulation such as the GDPR, an individual asks a company to delete all personal data it holds about them. Which concept is the individual exercising, and what should the company have in place to respond?
- ARight to be forgotten; a process to verify the requester, locate their data across systems, and erase it unless a legal retention duty applies
- BData portability; a process to export the person's data in a machine-readable format and transmit it to them or another controller
- CRight of access; a process to give the person a copy of their data and explain the purposes and recipients of the processing
- DData minimization; a policy limiting future collection to only the fields needed for the purpose stated at collection time
Show answer and explanation
Answer: A) Right to be forgotten; a process to verify the requester, locate their data across systems, and erase it unless a legal retention duty applies
A request to delete one's personal data invokes the right to erasure ('right to be forgotten'). The controller needs a process to verify the request, find the data, and delete it, while still honoring legal retention obligations.
- AThe GDPR grants data subjects the right to have personal data erased in certain circumstances (the 'right to be forgotten'). To respond, the controller has to discover the data, act on the request, and weigh legal retention obligations such as those in Article 17(3)(b).
- BPortability is a request to receive or transfer a copy of the data in a structured, machine-readable format. It does not delete anything.
- CAn access request asks for a copy of the data and information about how it is processed. It is not a request for deletion.
- DData minimization is a principle the organization applies when it collects data. It is not a right that an individual exercises, and it does not handle a request to delete data the company already holds.
Other Security Program Management and Oversight objectives
Also: the Security Program Management and Oversight domain page (20% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.