Compliance obligations are the legal or regulatory duties that apply to a system based on where it is used, who uses it, and what data or decisions it handles. In cybersecurity, these duties shape how an organization must secure data, log activity, retain records, manage access, report incidents, and document controls.
They matter because a technically secure system can still create risk if it violates privacy, sector, export, or safety rules. Different deployments of the same tool may trigger different obligations, so teams must map the system’s purpose, jurisdiction, and data flows before release. Attackers often exploit weak compliance practices indirectly, such as through poor retention, missing audit trails, or unclear ownership that hides abuse. Defenders use compliance obligations to define minimum controls, prove accountability, and support audits and incident response. In practice, compliance is not just paperwork; it is part of the security boundary around the system.