2.1. Security and Compliance Concepts

💡 First Principle: Security and compliance are often taught as separate subjects, but on the ground they're the same activity viewed from two angles — security asks "are we actually protected?" while compliance asks "can we prove it, against a specific set of rules?" — and the controls you build (encryption, layered defenses, verified access) usually answer both questions at once.

Why this matters: an organization can be technically secure and still fail an audit (undocumented controls, no evidence trail), and it can pass an audit on paper while still being genuinely vulnerable (a checkbox exercise with stale controls). The five concepts in this section — shared responsibility, defense-in-depth, Zero Trust, encryption/hashing, and GRC — are the building blocks that, done well, satisfy both the "are we protected" and "can we prove it" questions simultaneously.

⚠️ Common Misconception: Treating security and compliance as two separate teams' problems, with no shared vocabulary or controls. In practice, Microsoft's own tooling (which you'll see in Phase 5) is built on the idea that compliance posture is measured through security controls — they are not independent tracks.