Compliance is not security. It is the *floor*, not the ceiling. A compliant organization meets a minimum bar defined by law or industry; a secure organization meets the actual threat. The two overlap heavily but they are not the same thing, and one of the most common career-limiting moves in security is treating them as identical.
This subsection introduces the five compliance regimes a US-trained security practitioner is most likely to encounter early. HIPAA applies to anyone handling US healthcare data — far more organizations than just hospitals. PCI-DSS applies to anyone touching payment cards, which means nearly every business that takes money online. GDPR applies whenever an EU resident's personal data is processed, which means most US companies of any size by default. SOX applies to US public companies (and the security teams that operate their IT general controls). FERPA applies to nearly every US educational institution and the vendors that serve them.
Each page covers the same axes: who's covered, what the standard requires, who enforces it, what the penalties look like, and what it actually means for a security team day-to-day. The goal is fluency, not legal expertise — enough to talk credibly with auditors, understand why your organization makes certain technical choices, and know when to call counsel.