Explain like I'm five · Security

What is Compliance?

Compliance and audit, told as a story about rules written by the neighboring kingdoms and an inspector who comes to see the proof.

the neighboring kingdomsTHE RULESguest lists must be sealedledgers kept for 7 yearsthree checks at every dooreveryone takes the thief classour castlenot our rules — the kingdoms around us wrote them

The kingdoms around us wrote the rules. Every castle has to follow them.Not our rules. Guest lists must be sealed, ledgers kept seven years, every door checked three times.

the inspectorany proof the lists were sealed?proof papers'we did… I think'the inspector doesn't trust — he looks

The inspector comes. Words aren't enough.The inspector doesn't trust — he looks. Not "we did it," but the log and the paper that show it.

THE CHECKLISTruleprooflists sealed→copy of the sealed letterkept 7 years→the how-long tablethree checks→the gatekeeper's logthief class→the attendance sheetPASSEDthe stamp = a certificatefor every rule, a matching paper of proofpass and you get the stamp; fail and you pay

Compliance is putting a paper of proof next to every rule.One rule, one proof. If the inspector finds them all, he stamps it. That stamp is the certificate. Miss one, and there's a fine.

Rules come from outsidethe neighbors write them
Match the proofpaper, not words
Pass, get the stampguests come trusting
Rules are the floornot the ceiling
PASSEDthe stamp on the gatepassedguests come, trustingFINEfaileda fine — and the gossipthe neighbors wrote the rules, so the neighbors punish

Pass, and the stamp goes on the gate. Fail, and there's a fine.The neighbors wrote the rules, so the neighbors punish. Worse than the fine is the gossip — that castle doesn't follow the rules.

PASSEDwe got the stamp — why a thief?the rules are the floorthieves don't read the rulesthe stamp says we complied — not that we're safe

The stamp doesn't stop thieves. Rules are the floor, not the ceiling.Thieves don't read the rules. The stamp says we complied — not that we're safe. Real protection comes from the scale and the guard room.

In one breath

Compliance = for every rule the neighbors wrote, keep matching proof, and when the inspector looks, earn the stamp. The stamp is the floor, not safety itself.

Meeting the controls that laws, regulations, and standards (GDPR, privacy acts, ISO 27001) require, and proving it with evidence at audit time. Certification means the requirements were met — not that a breach can't happen.

When grown-ups say it

Compliance
Proof next to every rule. Following the rules the neighbors wrote, and being able to show it. Our own castle's rules → the rule scroll
Audit
The inspector's visit. Doesn't trust — looks. Our own people can look first (internal audit), or someone from outside comes (external audit).
Control
One line of the rules. Something like three checks at every door. One row on the checklist.
Evidence
The proof paper. Logs, copies, attendance sheets. Made as you go — you can't make them the night before. → the one-line log
Certification (ISO 27001)
The stamp on the gate. An outside inspector's stamp saying this castle keeps the rules. Renewed every few years.
Privacy law (GDPR, 개인정보보호법)
The guest-list rules. How a kingdom says guest names and addresses must be handled. Seal them, don't keep them long. → the colored stamp
Gap analysis
Looking before the inspector does. Open the checklist yourself and find the empty rows. Those are the gaps.
Retention
The seven-year rule. If what should be there isn't, that's a fine. → every paper's burning day
Next story
The Castle Rule Scroll →
Want another term as a picture book? Request →