---
{
  "title": "Compliance and assurance",
  "summary": "Demonstrate that applicable requirements are met, while managing broader risk.",
  "topic": "grc",
  "level": "Beginner",
  "updated": "2026-10-12",
  "units": [
    4
  ],
  "aliases": [],
  "sources": [
    {
      "title": "NIST: Cybersecurity Framework 2.0 FAQs",
      "url": "https://www.nist.gov/cyberframework/faqs"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

Compliance concerns meeting applicable laws, regulations, contracts, policies, or standards. Assurance evaluates evidence about whether requirements and controls operate as intended. Identify the actual scope and authority rather than assuming every framework applies to every organization. Compliance can support security, but meeting a set of requirements does not remove all risk. Maintain ownership, evidence, and a process for changes in obligations.

## In practice

An organization maps a contractual access-review requirement to a control owner, review procedure, and retained evidence of completed reviews.

## A common misunderstanding

Security and compliance overlap but are not identical. A passing assessment is limited to its scope, time, and criteria.

## Check your understanding

What should precede a compliance checklist?

**Think it through:** A determination of which obligations apply and which assets, processes, and organizations are in scope.


## Requirements and risk answer related questions

Compliance asks whether applicable requirements are satisfied. Those requirements may come from law, regulation, contracts, standards, or internal policy. Risk management asks what harmful outcomes are plausible and how the organization will address them. Meeting a particular requirement can reduce risk, but the requirement's scope may not cover every important threat or dependency.

First establish applicability and scope. A payment-data requirement, a privacy duty, and an internal administrator-access rule apply for different reasons. Record the relevant interpretation and accountable owner. A short educational note cannot determine every legal or contractual obligation for a specific organization; use responsible specialists and authoritative texts for that decision.

## A fictional audit boundary

An academy successfully demonstrates access reviews for its finance application. That evidence does not automatically establish that every learning platform, cloud service, and legacy database has equivalent controls. The assurance claim must stay within the reviewed scope and period. Overstating it can give decision makers a false picture of protection.

Compliance work is stronger when evidence collection is integrated with ordinary operation. Retaining approved access requests and review outcomes as they occur is more reliable than reconstructing them just before an audit. Audit findings should lead to owned corrective actions and verification, rather than a temporary cleanup that disappears once the review ends.

## Bound an assurance statement

For a fictional access-review exercise, write the requirement, systems included, period covered, evidence examined, and unresolved exception. Then draft a one-sentence conclusion that does not exceed those facts. Avoid saying the organization is secure. The useful skill is explaining exactly what has been demonstrated and which questions remain outside the evidence.

## Keep exploring

- [[compliance-evidence]]
- [[security-policy]]
- [[risk-assessment]]