Cybersecurity Law and Legal Fundamentals
Domain 1: Cybersecurity Law and Legal Fundamentals
This domain tests whether you can identify the legal source that creates an obligation, who has jurisdiction, and what standard applies before you reach for a control. C CLE questions often contrast statutes, regulations, contracts, and voluntary frameworks, then ask which one binds a given organization.
Sources and hierarchy
- Constitutional limits, statutes, regulations, common-law duties, and treaties are law. NIST CSF, ISO/IEC 27001, and CIS Controls are voluntary unless a contract, regulation, or incorporation by reference makes them mandatory.
- Criminal law punishes prohibited conduct (CFAA, 18 U.S.C. § 1030); civil law allocates duties and damages (negligence, breach of contract). The same incident can trigger both.
- Jurisdiction can be territorial, nationality-based, protective, or universal. GDPR Article 3 reaches non-EU organizations that offer goods or services to, or monitor, EU data subjects. The CLOUD Act addresses cross-border access to stored data by U.S. authorities.
Core doctrines
- Privacy roles matter: GDPR controller/processor; HIPAA covered entity/business associate; CCPA business/service provider. Duties flow from the role, not the job title.
- Authorization is central to computer-crime analysis. Under CFAA, "exceeds authorized access" is not any policy violation; Van Buren v. United States (2021) narrowed it to accessing areas of a computer or data one is not entitled to access.
- ECPA divides interception (Wiretap Act), stored content (Stored Communications Act), and dialing/address records (Pen Register Act). Content generally needs a warrant; non-content records may be available by subpoena, depending on statute and age.
Worked example
A U.S. SaaS vendor with EU customers suffers an employee data download. The employee had credentials but opened a payroll folder unrelated to her role. Analysis: GDPR may apply because the vendor targets EU customers; the SCA governs disclosure of stored content to the government; CFAA exposure is stronger if she accessed a folder she was not entitled to use, not merely if she breached an internal policy. A contract clause or ISO certificate does not create criminal liability.
Traps
- Treating a framework as a statute.
- Assuming GDPR stops at EU borders.
- Equating a policy violation with CFAA "exceeding authorized access."
- Mixing controller and processor obligations.
- Forgetting that contracts can incorporate standards and create enforceable duties.