Compliance starts with knowing which obligations actually apply and ends with evidence that would satisfy an assessor. Each scenario hands you a fictional company's profile, control set or evidence binder: decide which regimes apply and why, map one control to many obligations and find the gaps, judge whether evidence is sufficient, out of period or out of scope, and keep recurring obligations on the right cycle. Training material describing well-known requirements, not legal advice.
A US health-products retailer sells online by card, hosts a patient results portal for a clinic partner, ships to customers in the EU and is listed on a US exchange. Decide which of six regimes apply, name the fact that decides each one, and answer a colleague who says the payment provider makes PCI DSS someone else's problem.
Ten obligations from PCI DSS, HIPAA, GDPR and SOX sit in the register next to five implemented controls. Map each obligation to the control that satisfies it - one control can cover several regimes - mark the obligations nothing covers, and judge which evidence-reuse claims hold up.
The evidence binders for the annual compliance review look full. Click the items an assessor would reject: a scan from outside the period, a penetration test of the wrong network, a risk analysis that is only a policy, an access review with no proof of follow-up, a review of an out-of-scope system and a DPIA dated after launch.
It is 1 October and the obligations register has fallen behind. Put nine recurring and event-driven obligations on the right cycle - every three months, every twelve months, before processing starts, or within 72 hours - flag the ones that are overdue, and decide what to do about a breach clock that is already running.