NajmaGRC/Compliance-Frameworks

Compliance programme design, breach analysis across two jurisdictions, and security policy development — Kenya DPA, GDPR, PCI DSS, AML. # Compliance Frameworks & Breach Analysis **GRC101 & GRC104 | International Cybersecurity and Digital Forensics Academy** > Compliance is not a checkbox — it is where systems, regulation and reality either align or don't. This repository documents compliance programme design, regulatory breach analysis, and security policy development across real-world frameworks and scenarios. --- ## 📌 What This Repository Contains Three substantial compliance projects covering: regulatory breach analysis across two jurisdictions, a complete compliance programme built under crisis conditions, and an institutional security policy and procedural manual. --- ## 🗂️ Project 1 — Comparative Breach Analysis: Worldcoin Kenya & MGM Resorts **File:** `Worldcoin-Kenya-vs-MGM-Breach-Analysis.pdf` A comparative analysis of two cybersecurity incidents from opposite ends of the global compliance spectrum — one rooted in African data privacy law, one in a multinational ransomware attack. | | Worldcoin Kenya | MGM Resorts International | |---|---|---| | **Incident type** | Data privacy breach — unlawful biometric collection | Social engineering → ransomware attack | | **Regulation** | Kenya Data Protection Act 2019, GDPR | PCI DSS, CCPA, GDPR, Gaming Commission | | **Detection** | Public outcry → ODPC investigation | Internal detection → self-reported | | **Outcome** | High Court ordered permanent data erasure (May 2025) | $100M+ losses, no ransom paid, systems restored in 10 days | | **Root cause** | No DPIA, no informed consent, data sovereignty violations | Social engineering, no MFA, no network segmentation | **Why this analysis matters:** The Worldcoin case is a landmark in African data protection — 508,569 Kenyan citizens' biometric data collected unlawfully, with socioeconomic factors (poverty, illiteracy) exploited as part of the mechanism. It exposes the gap between policy existence and enforcement in emerging markets, and what it means for organisations operating across jurisdic …