IT Regulations and Compliance
Table of Contents
Click Here to Return To the IT Career Playbook
Compliance is not a checkbox exercise for lawyers. Senior IT professionals are responsible for implementing and maintaining the controls that keep organizations legally and contractually compliant. Ignorance of the applicable framework is not a defense when an auditor or regulator asks why a control is missing.
The frameworks below are not interchangeable. Each targets a specific industry, risk profile, or government context. You need to know which ones apply to your employer and what your role is in satisfying them.
ITIL 4: IT Service Management
ITIL 4 (IT Infrastructure Library) is a service management framework, not a compliance regulation. It defines how IT teams should deliver and improve services. Organizations adopt ITIL to reduce incident impact, standardize change processes, and link IT work to business value.
Key ITIL 4 concepts you will encounter at senior levels:
- Service value chain — the model connecting demand to value delivery.
- Change enablement — process for approving and tracking changes to minimize risk.
- Incident management — structured approach to restoring service quickly.
- Problem management — root cause analysis to prevent recurrence.
- CMDB (Configuration Management Database) — the inventory of IT assets and their relationships.
ITIL 4 Foundation certification is a common requirement for IT service manager and operations lead roles.
NIST Frameworks
The National Institute of Standards and Technology (NIST) publishes frameworks widely adopted across government and enterprise.
| Framework | What It Covers |
|---|---|
| NIST SP 800-53 | Security and privacy controls for federal information systems |
| NIST CSF 2.0 | Cybersecurity risk management for any organization |
| NIST SP 800-171 | Protecting controlled unclassified information (CUI) in non-federal systems |
| NIST RMF | Risk Management Framework for FedRAMP and FISMA compliance |
SP 800-53 is the most comprehensive. It defines control families covering access control, audit and accountability, incident response, configuration management, and more. If your employer holds a federal contract, 800-53 or 800-171 is almost certainly in scope.
SOC 2
SOC 2 (System and Organization Controls 2) is an auditing standard from the AICPA. It applies to SaaS and cloud service providers that store or process customer data. A SOC 2 Type II report proves to customers that your security controls operate effectively over time.
SOC 2 is organized around five Trust Services Criteria:
- Security — the mandatory criterion, also called the “Common Criteria.”
- Availability — system uptime and performance commitments.
- Processing Integrity — data processed correctly and completely.
- Confidentiality — sensitive data protected from unauthorized access.
- Privacy — personal data collected, used, and disclosed appropriately.
IT professionals working at SaaS companies will interact with SOC 2 through control evidence collection: pulling access logs, change records, vulnerability scan results, and training completion records for auditors.
HIPAA
HIPAA (Health Insurance Portability and Accountability Act) governs the protection of protected health information (PHI) in healthcare and healthcare-adjacent organizations. If your employer handles medical records, health insurance data, or works as a business associate of a covered entity, HIPAA applies.
Key HIPAA rules for IT:
- Security Rule — requires administrative, physical, and technical safeguards for electronic PHI (ePHI).
- Breach Notification Rule — mandates notification timelines when ePHI is exposed.
- BAA (Business Associate Agreement) — contract required when sharing ePHI with vendors.
Technical safeguards include encryption at rest and in transit, audit controls, automatic session logoff, and user authentication.
FedRAMP
FedRAMP (Federal Risk and Authorization Management Program) is a U.S. government program for authorizing cloud services used by federal agencies. Cloud providers must achieve a FedRAMP authorization before federal agencies can purchase their services.
If you work at a cloud or SaaS company selling to the government, FedRAMP compliance requires implementing NIST SP 800-53 controls and undergoing a formal assessment by a Third Party Assessment Organization (3PAO).
PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) applies to any organization that stores, processes, or transmits cardholder data. Retailers, e-commerce platforms, payment processors, and hospitality companies are the most common context.
PCI DSS v4.0 organizes requirements into six goals and twelve core requirements covering network segmentation, access control, encryption, vulnerability management, logging, and penetration testing.
Non-compliance can result in fines, card brand penalties, and loss of the ability to process credit cards.
