Security Governance & Compliance Frameworks

The rulebook and the referees: what standards must we follow, who checks we’re following them, and what happens when we’re not.

At a glance

• What it is: the organizational structure that defines what “secure enough” means (via frameworks like ISO 27001, NIST CSF, SOC 2, PCI-DSS), assigns ownership for meeting those standards, and audits whether they’re actually being met.
• Why it matters: without shared standards and an audit process, every team defines “secure enough” differently — governance turns security from a matter of opinion into a consistently enforced, auditable bar.
• For developers: if a control (encryption, access review, logging) is required by a framework your organization follows, treat it as a real requirement, not a suggestion — auditors will ask for evidence, not intentions.
• When to use it: any organization handling customer data, payments, or operating in a regulated industry needs at least one governing framework and a way to demonstrate compliance with it.
• When not to use it: a very early-stage project with no customers or regulatory exposure may defer formal governance, but should still follow baseline good practice so retrofitting isn’t a rewrite later.
• Prerequisites: Encryption & Key Management and Identity & Access Management (IAM) — governance frameworks typically mandate both as baseline controls.

Mental model

flowchart LR
    F[Chosen framework - e.g. PCI-DSS, ISO 27001] --> P[Policies and required controls]
    P --> O[Control owners implement and maintain]
    O --> A[Audit checks evidence]
    A -- Gap found --> R[Remediation plan]
    A -- Compliant --> C[Certification / attestation]

Step-by-step walkthrough

1. Identify which frameworks apply to the organization (e.g. PCI-DSS for payment card data, ISO 27001 or SOC 2 for general security posture, industry-specific regulations).
2. Translate framework requirements into concrete, owned controls (e.g. “encryption key rotation” becomes a specific KMS rotation policy with a named owner).
3. Collect evidence continuously (automated where possible) rather than scrambling to produce it right before an audit.
4. Run internal audits/reviews on a regular cadence, not just when an external auditor requires one.
5. When a gap is found, document a remediation plan with an owner and a deadline, and track it to closure.

Worked example

The same PCI-DSS audit that flagged unrotated payment gateway keys (see Encryption & Key Management) also reveals there’s no documented owner for key management as a control, and no evidence trail showing when rotations happened.

• Input: a technically fixable gap (unrotated keys) combined with a governance gap (no assigned control owner, no audit evidence).
• Process: the team assigns a named control owner for key management, configures the KMS to automatically log rotation events as audit evidence, and maps this control explicitly to the relevant PCI-DSS requirement so future audits can verify it directly.
• Output: the technical fix (automated rotation) and the governance fix (ownership + evidence trail) together close the audit finding, and the next audit cycle takes far less manual effort because evidence is generated continuously. Microsoft Purview Compliance Manager tracks the PCI-DSS control mapping and its owner, while Azure Key Vault’s rotation logs (surfaced through Azure Monitor) provide the continuous evidence trail auditors can query directly instead of a manual export.

Common use cases

Use case	When to use	Notes
Handling payment card data	Before processing any card data	PCI-DSS applies; map required controls (encryption, access control, logging) explicitly
Selling to enterprise customers	Often required before contracts close	SOC 2 or ISO 27001 attestation is frequently a sales prerequisite
An audit finds a gap	Immediately	Assign an owner and remediation deadline; track to closure, don’t just note it
Adding a new system that touches regulated data	At design time	Map its controls to the relevant framework requirements before launch, not after

Advanced details

• Framework vs. certification: a framework (e.g. NIST CSF) is a structured set of practices; a certification/attestation (e.g. SOC 2 report, PCI-DSS Attestation of Compliance) is formal evidence that an independent party verified compliance.
• NIST CSF 2.0’s six functions: Govern, Identify, Protect, Detect, Respond, and Recover — Govern (setting risk strategy, roles, and policy) was added in CSF 2.0 as the function every other function operates under, reflecting that a framework without assigned ownership (this page’s “control owner”) tends to drift regardless of how good Identify/Protect/Detect/Respond/Recover controls are individually.
• Continuous compliance: automating evidence collection (e.g. KMS rotation logs, access review exports) turns audits from a fire drill into a report generation exercise.
• Control ownership: every required control should have one accountable owner — a control with no owner tends to silently decay until an audit finds it.

Quick reference

Term	Meaning
Framework	A structured set of security practices/requirements (ISO 27001, NIST CSF, PCI-DSS, SOC 2)
Control	A specific, implemented requirement mapped to a framework (e.g. key rotation)
Attestation / certification	Formal, independently verified evidence of compliance
Control owner	The accountable person/team responsible for a specific control
Remediation plan	A documented, owned, deadlined plan to close an identified gap
NIST CSF 2.0 functions	Govern, Identify, Protect, Detect, Respond, Recover — the six functions of the current NIST Cybersecurity Framework

Troubleshooting

Symptom	Likely cause	Fix
Audits require weeks of manual evidence-gathering	Evidence isn’t collected continuously	Automate logging/evidence collection as controls run, not after the fact
The same finding recurs audit after audit	No owner or remediation deadline was assigned	Assign a named owner and a tracked deadline for every finding
Teams disagree on what “secure enough” means	No shared framework adopted	Formally adopt a framework and map concrete controls to it

Check your understanding

• Why does a technical fix (like key rotation) often need a governance fix (like an assigned owner) alongside it to actually close an audit finding?
• What’s the difference between a framework and a certification/attestation?

Related pages

Part of Introduction to Security Architecture. See also Encryption & Key Management, Data Privacy, Security & Compliance, Incident Response & Security Operations, and the Glossary.