Cybersecurity is built on security controls. These controls can be organizational, procedural and regulatory (compliance), as well as technical. Faced with a new service, be it a website or an essential service that supports a critical infrastructure, the technological risk must be evaluated and managed, selecting which controls should be applied. 

An essential point in risk assessment is compliance: the identification of laws, regulations and standards that must be respected and complied with throughout all phases of the service life cycle, which includes design, construction, deployment, maintenance, operation and withdrawal. 

Numerous legislations have been passed in recent years on both a national and an international level. Companies must adhere to one or numerous regulations depending on the industry to which they belong, the country in which they operate, or the legal framework under which they carry out their functions.