HKSM

Laws and Regulations are mandatory external rules from governments, standards bodies, or industry groups that constrain how the product is built, delivered, and operated. In SBOK, they act as an input to shape epics, user stories, acceptance criteria, Definition of Done, and release plans, and as an output they produce documented compliance artifacts and evidence.

Key Points

• External constraints that the Scrum Team must follow across all sprints and releases.
• Input to backlog creation, refinement, estimation, and Definition of Done.
• Drive non-functional requirements, acceptance criteria, and compliance tests.
• Produce outputs such as traceability, audit evidence, and compliance sign-offs.
• Product Owner owns prioritization, supported by legal/compliance SMEs and the Scrum Master.
• Changes in regulations are treated as backlog changes and can impact scope, schedule, and risk.

Purpose

Laws and regulations ensure the product and process meet mandatory obligations, reducing the risk of penalties, rework, or blocked releases. They provide a baseline for governance and predictable delivery in regulated environments.

In Scrum, they connect business value to safe delivery by translating legal clauses into clear backlog items, definition-of-done checks, and verifiable acceptance criteria.

Key Terms & Clauses

• Regulatory requirement - a mandatory rule enforced by an authority.
• Standard - an adopted norm (industry or national) that may be mandatory or contractual.
• Clause - the specific paragraph or reference number in a law or standard.
• Non-functional compliance - security, privacy, accessibility, safety, or retention constraints.
• Audit evidence - artifacts that prove compliance (logs, test results, approvals).
• Traceability - mapping from clauses to epics, user stories, tests, and deliverables.

How to Develop/Evaluate

1. Collect sources: identify applicable jurisdictions, standards, and organizational policies; engage legal/compliance SMEs.
2. Interpret and decompose: translate clauses into measurable acceptance criteria and non-functional requirements.
3. Prioritize: add items to the Product Backlog; mark compliance-critical items and minimum legal obligations.
4. Refine and estimate: clarify scope in backlog refinement; identify tasks, spikes, and test cases.
5. Embed controls: add compliance checks to the Definition of Done and create a lightweight compliance checklist.
6. Validate: execute tests in each sprint; gather evidence during Demonstrate and Validate Sprint.
7. Maintain: monitor regulatory changes; update backlog and risk register when rules change.

How to Use

As an input, laws and regulations guide Create Prioritized Product Backlog, Create User Stories, Approve/Estimate/Commit User Stories, Create Tasks, and Create Sprint Backlog. They inform acceptance criteria, sizing, and sequencing based on mandatory dates.

As an output, sprints produce compliance-ready deliverables, updated Definition of Done checks, traceability links from clauses to stories and tests, and release documentation for audits. They are verified during Demonstrate and Validate Sprint and consolidated in Ship Deliverables.

Example Snippet

User Story: As a user, I want my personal data handled safely so that it meets legal requirements.

• Acceptance criteria: Data in transit is encrypted using an approved protocol (maps to Clause 12.3).
• Acceptance criteria: User consent is recorded with timestamp and purpose (maps to Clause 7.1).
• DoD: Compliance checklist completed; automated tests and logs stored for audit.

Risks & Tips

• Risk: Misinterpreting a clause leads to rework or release delays. Tip: review with legal SMEs and use examples.
• Risk: Ignoring local or cross-border rules. Tip: explicitly list jurisdictions and data residency constraints.
• Risk: Over-engineering controls. Tip: implement minimum viable compliance and iterate.
• Risk: Late discovery of mandatory dates. Tip: add compliance milestones and monitor regulatory calendars.
• Tip: Keep a simple traceability matrix linking clauses to stories, tests, and evidence.
• Tip: Automate compliance tests where possible and store artifacts in a central repository.

PMP/SCRUM Example Question

A new regulation takes effect in 6 weeks, and mid-sprint you learn a key clause affects current work. What should the Scrum Master coach the team to do first?

1. Pause the sprint and immediately add the new tasks to the Sprint Backlog.
2. Escalate to the PMO to get a schedule extension before acting.
3. Add the change to the Product Backlog for the Product Owner to re-prioritize and assess sprint impact.
4. Update the Definition of Done retroactively to include the new clause for all past sprints.

Correct Answer: C — Add the change to the Product Backlog for the Product Owner to re-prioritize and assess sprint impact.

Explanation: Regulatory changes are treated as backlog changes. The Product Owner evaluates priority and, with the team, decides on scope adjustments or whether the Sprint Goal is jeopardized.