Laws and Regulations

Laws and Regulations are mandatory external rules from governments, standards bodies, or industry groups that constrain how the product is built, delivered, and operated. In SBOK, they act as an input to shape epics, user stories, acceptance criteria, Definition of Done, and release plans, and as an output they produce documented compliance artifacts and evidence.

Key Points

  • External constraints that the Scrum Team must follow across all sprints and releases.
  • Input to backlog creation, refinement, estimation, and Definition of Done.
  • Drive non-functional requirements, acceptance criteria, and compliance tests.
  • Produce outputs such as traceability, audit evidence, and compliance sign-offs.
  • Product Owner owns prioritization, supported by legal/compliance SMEs and the Scrum Master.
  • Changes in regulations are treated as backlog changes and can impact scope, schedule, and risk.

Purpose

Laws and regulations ensure the product and process meet mandatory obligations, reducing the risk of penalties, rework, or blocked releases. They provide a baseline for governance and predictable delivery in regulated environments.

In Scrum, they connect business value to safe delivery by translating legal clauses into clear backlog items, definition-of-done checks, and verifiable acceptance criteria.

Key Terms & Clauses

  • Regulatory requirement - a mandatory rule enforced by an authority.
  • Standard - an adopted norm (industry or national) that may be mandatory or contractual.
  • Clause - the specific paragraph or reference number in a law or standard.
  • Non-functional compliance - security, privacy, accessibility, safety, or retention constraints.
  • Audit evidence - artifacts that prove compliance (logs, test results, approvals).
  • Traceability - mapping from clauses to epics, user stories, tests, and deliverables.

How to Develop/Evaluate

  1. Collect sources: identify applicable jurisdictions, standards, and organizational policies; engage legal/compliance SMEs.
  2. Interpret and decompose: translate clauses into measurable acceptance criteria and non-functional requirements.
  3. Prioritize: add items to the Product Backlog; mark compliance-critical items and minimum legal obligations.
  4. Refine and estimate: clarify scope in backlog refinement; identify tasks, spikes, and test cases.
  5. Embed controls: add compliance checks to the Definition of Done and create a lightweight compliance checklist.
  6. Validate: execute tests in each sprint; gather evidence during Demonstrate and Validate Sprint.
  7. Maintain: monitor regulatory changes; update backlog and risk register when rules change.

How to Use

As an input, laws and regulations guide Create Prioritized Product Backlog, Create User Stories, Approve/Estimate/Commit User Stories, Create Tasks, and Create Sprint Backlog. They inform acceptance criteria, sizing, and sequencing based on mandatory dates.

As an output, sprints produce compliance-ready deliverables, updated Definition of Done checks, traceability links from clauses to stories and tests, and release documentation for audits. They are verified during Demonstrate and Validate Sprint and consolidated in Ship Deliverables.

Example Snippet

User Story: As a user, I want my personal data handled safely so that it meets legal requirements.

  • Acceptance criteria: Data in transit is encrypted using an approved protocol (maps to Clause 12.3).
  • Acceptance criteria: User consent is recorded with timestamp and purpose (maps to Clause 7.1).
  • DoD: Compliance checklist completed; automated tests and logs stored for audit.

Risks & Tips

  • Risk: Misinterpreting a clause leads to rework or release delays. Tip: review with legal SMEs and use examples.
  • Risk: Ignoring local or cross-border rules. Tip: explicitly list jurisdictions and data residency constraints.
  • Risk: Over-engineering controls. Tip: implement minimum viable compliance and iterate.
  • Risk: Late discovery of mandatory dates. Tip: add compliance milestones and monitor regulatory calendars.
  • Tip: Keep a simple traceability matrix linking clauses to stories, tests, and evidence.
  • Tip: Automate compliance tests where possible and store artifacts in a central repository.

PMP/SCRUM Example Question

A new regulation takes effect in 6 weeks, and mid-sprint you learn a key clause affects current work. What should the Scrum Master coach the team to do first?

  1. Pause the sprint and immediately add the new tasks to the Sprint Backlog.
  2. Escalate to the PMO to get a schedule extension before acting.
  3. Add the change to the Product Backlog for the Product Owner to re-prioritize and assess sprint impact.
  4. Update the Definition of Done retroactively to include the new clause for all past sprints.

Correct Answer: C — Add the change to the Product Backlog for the Product Owner to re-prioritize and assess sprint impact.

Explanation: Regulatory changes are treated as backlog changes. The Product Owner evaluates priority and, with the team, decides on scope adjustments or whether the Sprint Goal is jeopardized.

Advanced Project Management — Measuring Project Performance

Move beyond guesswork and status reporting. This course helps you measure real progress, spot problems early, and make confident decisions using proven project performance techniques. If you manage complex projects and want clearer visibility and control, this course is built for you.

This is not abstract theory. You’ll work step by step through Earned Value Management (EVM), learning how cost, schedule, and scope come together to show true performance. You’ll build a solid foundation in EVM concepts, understand why formulas work, and learn how performance data actually supports leadership decisions.

You’ll master Work Breakdown Structures (WBS), control accounts, and budget baselines, then apply core EVM metrics like EAC, TCPI, and variance analysis. Through a detailed real-world example, you’ll forecast outcomes, analyze trends, and understand contingencies and management reserves with confidence.

Learn how experienced project managers monitor performance, communicate results clearly, and take corrective action before projects slip. With practical exercises and hands-on analysis, you’ll be ready to apply EVM immediately. Enroll now and start managing performance with clarity and control.



Become an AI-First Agile Leader!

HK School of Management empowers you to master AI as your most powerful co-pilot—without the complexity. Transform your agile leadership with practical, prompt-based workflows and proven strategies designed for real-world scrum challenges. For the price of lunch, you get the tools to automate mundane tasks, refine backlogs with precision, and drive unprecedented efficiency in your team. Backed by our 30-day money-back guarantee—zero risk, real impact.

Learn More