CCPC cheat sheet

Cyber policy is the set of authoritative decisions (laws, regulations, executive orders, standards) that allocate risk, responsibility, and resources across public and private actors.

Governance defines who decides, who is accountable, and how performance is measured; policy defines what outcomes are required.

Key U.S. federal cyber policy instruments: Executive Order 13636 (2013, critical infrastructure), the NIST Cybersecurity Framework (2014), the National Defense Authorization Act, and the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA, 2022).

The roles of CISA (coordination), FBI (law enforcement), NSA (signals intelligence), and DoD (defense) overlap; policy clarifies jurisdiction and information-sharing channels.

Policy life cycle: agenda setting → formulation → adoption → implementation → evaluation → revision.

A governance model typically includes a steering committee, a CISO, business unit owners, and internal audit; separation of duties prevents conflicts of interest.

Regulatory versus voluntary frameworks: regulation creates legal obligations with penalties; voluntary frameworks (e.g., NIST CSF) provide guidance without direct enforcement.

International governance bodies include the UN GGE/OEWG, ITU, and OECD; their outputs are norms and recommendations, not binding law unless transposed nationally.

Metrics for governance effectiveness include policy exception rates, control coverage, incident response times, and audit findings closure rates.

Risk = Threat × Vulnerability × Impact (qualitative) or likelihood × consequence (quantitative); risk is reduced by controls that lower likelihood, impact, or both.

NIST Cybersecurity Framework functions: Identify, Protect, Detect, Respond, Recover (plus Govern in CSF 2.0).

NIST SP 800-37 Risk Management Framework steps: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor.

ISO/IEC 27001 specifies requirements for an information security management system (ISMS); ISO/IEC 27005 provides risk management guidance.

FAIR (Factor Analysis of Information Risk) quantifies risk in monetary terms using loss event frequency and loss magnitude.

Risk treatment options: avoid, mitigate, transfer (insurance), accept; residual risk must be documented and approved by an accountable owner.

Threat modeling methods include STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) and attack trees.

Control types: preventive, detective, corrective, deterrent, compensating; controls can be administrative, technical, or physical.

Third-party/supply-chain risk requires vendor due diligence, contractual security requirements, and continuous monitoring.

U.S. federal cyber laws include the Computer Fraud and Abuse Act (CFAA, 1986), Electronic Communications Privacy Act (ECPA), Stored Communications Act (SCA), and the Cybersecurity Information Sharing Act (CISA, 2015).

State breach notification laws (e.g., California Civil Code 1798.82) require notice to affected individuals; timing and content vary by state.

Sector regulators: HIPAA (health), GLBA (financial), FERPA (education), and SEC rules on cybersecurity risk disclosure and incident reporting.

GDPR applies to any organization processing personal data of EU residents, regardless of location; fines up to 4% of global annual turnover or €20 million, whichever is greater.

Compliance is adherence to laws, regulations, and standards; it is a baseline, not a guarantee of security.

Contract law governs SLAs, indemnities, data processing agreements, and breach notification obligations between parties.

Evidence of compliance includes policies, audit logs, training records, penetration test reports, and third-party attestations (SOC 2, ISO 27001 certificates).

Legal privilege and incident response: engage counsel early to protect communications under attorney-client privilege.

Cross-border enforcement: the Budapest Convention facilitates international cooperation on cybercrime; MLATs govern formal evidence requests.

Incident response life cycle (NIST SP 800-61): Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.

Business continuity planning (BCP) focuses on sustaining critical business functions; disaster recovery (DR) focuses on restoring IT infrastructure.

Recovery objectives: Recovery Time Objective (RTO) = maximum acceptable downtime; Recovery Point Objective (RPO) = maximum acceptable data loss.

Business Impact Analysis (BIA) identifies critical processes, dependencies, and financial/operational impact of disruption.

Resilience includes redundancy, failover, backups (3-2-1 rule), and tested restoration procedures.

Crisis communication plans define spokespersons, channels, and escalation paths for internal and external stakeholders.

Tabletop exercises and simulations validate plans; after-action reports drive corrective actions.

Regulatory reporting deadlines: e.g., CIRCIA requires covered entities to report significant cyber incidents to CISA within 72 hours of reasonable belief and ransom payments within 24 hours.

Essential records and data classification determine backup priority and retention during recovery.

Personal data is any information relating to an identified or identifiable natural person; special categories (health, biometric, racial/ethnic, religious, sexual orientation) require higher protection.

Privacy principles (OECD/GDPR): lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability.

Data subject rights under GDPR include access, rectification, erasure, restriction, portability, and objection.

Cross-border transfer mechanisms: adequacy decisions, Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), and derogations.

Schrems II (2020) invalidated the EU-US Privacy Shield; the EU-US Data Privacy Framework (2023) provides a new adequacy mechanism.

Data protection impact assessments (DPIAs) are required for high-risk processing under GDPR Article 35.

Data localization laws require certain data to be stored or processed within national borders (e.g., China, Russia, India sectoral rules).

Breach notification under GDPR: 72 hours to supervisory authority where risk to rights and freedoms; without undue delay to data subjects where high risk.

Privacy by design and by default embed protections into systems and processes from the outset.

Information Sharing and Analysis Centers (ISACs) and Information Sharing and Analysis Organizations (ISAOs) facilitate sector-specific threat intelligence sharing.

CISA's Automated Indicator Sharing (AIS) enables real-time exchange of machine-readable cyber threat indicators using STIX/TAXII.

The Cybersecurity Information Sharing Act (CISA, 2015) provides liability protection for sharing cyber threat indicators with the federal government when done in accordance with its procedures.

Public-private partnerships (PPPs) pool resources, data, and expertise; governance must address trust, confidentiality, and antitrust concerns.

Traffic Light Protocol (TLP) markings (RED, AMBER, GREEN, CLEAR) govern how shared information may be further disseminated.

Sector Risk Management Agencies (SRMAs) coordinate with critical infrastructure owners and operators under Presidential Policy Directive 21 (PPD-21).

Trusted information sharing requires legal agreements (NDAs, MOUs) and technical standards (e.g., STIX 2.1, TAXII 2.1).

Fusion centers combine federal, state, and local intelligence to share threat information with private partners.

Challenges include data quality, timeliness, privacy, and fear of regulatory or reputational consequences from disclosure.

The UN Group of Governmental Experts (GGE) and Open-Ended Working Group (OEWG) develop voluntary norms for responsible state behavior in cyberspace.

The 2015 GGE consensus affirmed that international law, including the UN Charter, applies to cyberspace.

Key norms: states should not knowingly allow their territory to be used for internationally wrongful cyber acts; should not attack critical infrastructure; should respect human rights online; should cooperate on crime and terrorism.

Deterrence by denial reduces the likelihood of successful attack by hardening defenses; deterrence by punishment threatens retaliation (legal, economic, or military).

Attribution is the process of identifying the responsible actor; it is a political and technical act that enables consequences.

The Tallinn Manual (1.0 and 2.0) is an academic study of how international law applies to cyber operations, including sovereignty and use of force thresholds.

Confidence-building measures (CBMs) include exchanges of information, crisis hotlines, and joint exercises to reduce miscalculation.

The Budapest Convention on Cybercrime (2001) is the first international treaty harmonizing cybercrime laws and enabling cross-border cooperation.

Sanctions and indictments are common non-kinetic responses to malicious cyber activity; the U.S. uses the OFAC cyber sanctions program and DOJ indictments.

The NIST AI Risk Management Framework (AI RMF 1.0, 2023) organizes AI risk management into Govern, Map, Measure, and Manage functions.

The OECD AI Principles (2019) set international standards for trustworthy AI: inclusive growth, human rights, transparency, robustness, and accountability.

The EU AI Act (2024) classifies AI systems by risk (unacceptable, high, limited, minimal) and imposes obligations accordingly.

Cloud shared responsibility model: the provider secures the cloud infrastructure; the customer secures data, identities, and configurations in the cloud.

FedRAMP authorizes cloud services for U.S. federal agencies through standardized security assessment and continuous monitoring.

IoT security policy emphasizes device baseline requirements, vulnerability disclosure, and software bill of materials (SBOM).

Executive Order 14028 (2021) on Improving the Nation's Cybersecurity mandates SBOMs, zero trust, and software supply chain security for federal procurement.

Supply chain security frameworks include NIST SP 800-161 (C-SCRM) and the Cyber Supply Chain Risk Management guidance.

Post-quantum cryptography policy: NIST finalized its first PQC standards in 2024; organizations must plan migration for long-lived sensitive data.