Obligations, policy and investigations

Before a security officer says “we comply,” identify the source and scope of the obligation. A law may apply where people or processing are located; a customer contract, chosen sector standard or approved internal policy may create different duties. One organization's policy is not a universal law. An obligations register records source and edition, scope, accountable function, testable requirement, evidence, exception and review date. “The contract requires notice within a specified period after its definition of incident is met” differs from “every alert must be reported within that period.” Read the triggering definition and clock start rather than inventing a deadline from memory.

Cross-border data analysis requires a flow map, not just the name of the primary server location. Identify data, actors, destinations, support access, backup copies, key control and vendor access. Counsel then interprets the applicable grounds and restrictions for the named jurisdictions. Remote support from another country may matter even when primary storage is local; processing and storage are not always equivalent. Security does not make a unilateral legal conclusion, but must supply a technically accurate map for the decision.

Separate an approved policy, mandatory standard, operational procedure and optional guideline. “Protect customer records according to sensitivity” is direction. “Encrypt portable copies of the customer database with an organization-managed key” is a testable standard. The steps to create, rotate and recovery-test the key are a procedure. When reality differs, document an exception with owner, rationale, compensating measure and expiry; rewriting the standard after an event hides the gap. Investigation requirements also depend on authority and purpose: administrative investigation of employee conduct, criminal process led by competent authorities, civil contract dispute or regulatory inquiry. Agree early on evidence preservation, custody, access authority and retention. Evidence acquired without authority or an altered original log can weaken a case even if it seems technically revealing.