Laws - A high level, mandatory requirement by a governmental entity (i.e. Businesses must protect customer data.) Regulations - Detailed provisions that provide requirements for compliance with Laws (i.e. Businesses will use firewalls, encryption, and other access controls to protect customer data.) Policies - High level requirements issued by businesses and other organizations.