Which laws and standards are commonly relevant to organizational cybersecurity audits, and how should compliance testing be approached?

• A. HIPAA and PCI DSS only; test by controls review and traceability of evidence.
• B. GDPR/CCPA and GLBA only; test by evidence of compliance results.
• C. GDPR/CCPA, sectoral/privacy laws, SOX IT controls, GLBA, HIPAA, PCI DSS; test by policy review, controls mapping, and evidence of compliance testing results.
• D. No laws apply to cybersecurity audits.

Answer: (C)

Audits assess compliance across a broad mix of data privacy, financial controls, and industry-specific requirements, so the testing approach should verify not only that policies exist but that actual practices align with those policies and the applicable laws. The best answer recognizes that GDPR/CCPA, sectoral/privacy laws, SOX IT controls, GLBA, HIPAA, and PCI DSS collectively cover data privacy, financial data handling, and sector-specific protections in many organizations. A thorough testing approach combines policy review to confirm formal obligations, controls mapping to show traceability between requirements and implemented safeguards, and actual evidence of testing results that demonstrate both design and operating effectiveness. This means looking at how controls are designed, how they map to each regulation, and concrete test artifacts—plans, execution records, sampling methods, results, and remediation status—to prove compliance. The other options are narrower or incomplete: focusing on only a couple of regimes misses significant obligations, relying on a single type of evidence doesn’t prove ongoing effectiveness, and claiming no laws apply is simply not true in organizational cybersecurity audits.