CISSP Domain 1: Legal Compliance, Investigations and Security Policy

Introduction

This lesson continues Domain 1, Security and Risk Management (16% of the exam, ISC2 exam outline effective 15 April 2024). Building on professional ethics and security governance, this lesson explains CISSP legal and regulatory compliance. Here you learn the external rules the organization must obey (laws, regulations, contracts, industry standards), the way investigations are classified and conducted, and the internal documents (policies, standards, procedures, and guidelines) that turn those rules into daily behavior.

The official outline assesses legal and compliance issues, investigation types and security documentation; it does not provide an exhaustive list of statutes or predict individual exam questions. You are expected to recognize which kind of law or obligation applies to a scenario, what that implies for the security professional's next step, and which internal document type is appropriate. Always answer as a manager who protects the organization while staying inside the law and involving legal counsel.

Outline check, 27 October 2026: this lesson follows the currently effective 2024 outline. ISC2 has announced a replacement effective 15 April 2027; candidates testing then should review the upcoming outline.

Learning objectives

After this lesson you can:

1. Distinguish criminal, civil, and administrative law, and the legal systems (civil law, common law, religious and customary law, mixed).
2. Identify the main categories of cybercrime and the roles of major laws and treaties.
3. Differentiate patents, copyrights, trademarks, and trade secrets, and describe software licensing models.
4. Explain privacy principles and the main regimes (GDPR, HIPAA, GLBA, CCPA/CPRA, and others), and manage transborder data flow.
5. Describe import/export controls and contractual, industry, and regulatory obligations such as PCI DSS.
6. Compare administrative, criminal, civil, regulatory, and industry-standard investigations, with burdens of proof and evidence handling.
7. Distinguish policies, standards, baselines, procedures, and guidelines, and write them correctly.

1. Legal foundations

1.1 Legal systems

• Civil law (codified): legislatures write comprehensive codes; judges apply them. Common in continental Europe, Latin America, and parts of Asia. Do not confuse with "civil" lawsuits.
• Common law: based on precedent set by courts. Used in the United Kingdom, United States (federal and most states), Canada, Australia, and India.
• Religious and customary law: based on religious texts or long-standing custom; found in various jurisdictions, often mixed with other systems.
• Mixed systems: combine elements, for instance civil and customary law.

1.2 Branches of law that matter to security

These proof standards illustrate common US proceedings, not universal rules for every country or claim. Civil law also covers contract disputes, not only torts. Security professionals preserve evidence and support counsel; courts determine guilt or liability.

1.3 Jurisdiction

Attacks cross borders instantly, which complicates jurisdiction: which country's courts and laws apply. Factors include where the attacker, victim, and servers are located. Mutual legal assistance treaties and the Council of Europe Convention on Cybercrime (Budapest Convention) support cross-border cooperation, harmonizing definitions of computer crimes and procedures for evidence preservation and exchange.

2. Cybercrime and computer-related laws

2.1 Categories of computer crime

Computers play three roles: as the target (hacking, malware, denial of service), as the tool (fraud, phishing, extortion), and as incidental to the crime (a spreadsheet of drug transactions). Common categories: unauthorized access, data theft, ransomware and extortion, fraud, identity theft, intellectual property theft, child exploitation material, and attacks on critical infrastructure.

2.2 Notable laws and treaties (examples to recognize)

• Computer Fraud and Abuse Act (CFAA, US): criminalizes access "without authorization" or "exceeding authorized access" to protected computers.
• Electronic Communications Privacy Act (ECPA) and the Stored Communications Act: govern interception of and access to communications.
• Digital Millennium Copyright Act (DMCA, US): prohibits circumventing copyright protection technology and provides a notice-and-takedown safe harbor for online service providers.
• Sarbanes-Oxley Act (SOX, US): requires internal controls over financial reporting for public companies, which includes the IT systems supporting reports.
• Gramm-Leach-Bliley Act (GLBA, US): safeguards and privacy duties for financial institutions.
• HIPAA and HITECH (US): privacy, security, and breach notification for protected health information (PHI) held by covered entities and business associates.
• FISMA (US): security program duties for federal agencies and their contractors.
• GDPR (EU): general data protection regulation (section 4).
• NIS2 Directive (EU): cybersecurity risk management and reporting duties for essential and important entities, with management accountability.
• Computer Misuse Act (UK) and comparable national laws.
• Budapest Convention: international treaty on cybercrime.

You do not need details. You do need to match the regulation to the sector: health data points to HIPAA, financial institutions to GLBA, listed companies' financial reporting to SOX, EU establishment or targeting/monitoring people in the EU to GDPR, payment card data to PCI DSS (contractual, not law).

2.3 Attack attribution and the security professional's role

When you suspect a crime: preserve evidence, notify management and counsel, follow the incident response plan, and let law enforcement decide on prosecution. Never "hack back." Counterattacking is generally illegal and can harm innocent systems used as relays.

3. Intellectual property

3.1 The four main types

For security, trade secrets are the most relevant: the organization loses protection if it fails to take reasonable measures. That makes access control, classification, and NDAs legally important.

3.2 Software licensing

• Commercial/proprietary licenses: per-user, per-device, per-core, or subscription; terms define permitted copying, installation and use; enforceability and statutory exceptions vary by jurisdiction.
• Open source: permissive licenses (MIT, BSD, Apache 2.0) allow reuse with few obligations; copyleft licenses impose conditions when covered modified works are distributed or conveyed. GPL private internal modification does not itself require public release; exact duties depend on the license and integration.
• Shareware, freeware, and public domain have differing limits.
• End-user license agreements (EULA): click-wrap or shrink-wrap contracts.
• Software piracy is addressed by license management, software asset inventories, and audits (a business association may audit for compliance).
• Escrow: source code is held by a third party and released if the vendor fails, protecting the customer's continuity.

3.3 Protecting intellectual property

Classification, DLP, valid confidentiality agreements, exit procedures and proportionate monitoring can help protect IP. Non-compete restrictions vary substantially by jurisdiction and should not be assumed valid. Insider theft of trade secrets is a classic exam theme.

4. Privacy

4.1 Core principles

Privacy frameworks (the OECD Guidelines, the Fair Information Practice Principles, and the GDPR) share these ideas: lawfulness and consent or another legal basis; purpose limitation; data minimization; accuracy; storage limitation (retention); integrity and confidentiality; accountability; transparency; and individual rights (access, correction, erasure, portability, objection).

Key vocabulary:

• Personally identifiable information (PII) / personal data: information that identifies or can identify a person, directly or in combination.
• Data subject: the person the data is about.
• Controller: decides the purposes and means of processing. Processor: processes on the controller's instructions. The controller remains accountable for choosing compliant processors and must have a contract.
• Privacy by design and by default: build privacy in from the start; the default settings are the most protective.
• Data protection impact assessment (DPIA): required for high-risk processing under the GDPR.
• Data protection officer (DPO): an independent role required in some cases.

4.2 Major regimes

4.3 Transborder data flow

Moving personal data across borders is regulated. Under the GDPR, transfers outside the EEA need a mechanism: an adequacy decision by the European Commission, standard contractual clauses (SCCs), binding corporate rules (BCRs) for intra-group transfers, or specific derogations. History worth knowing: the EU-US Safe Harbor was invalidated in 2015 and the Privacy Shield in 2020 (the Schrems cases), because of concerns about US government access. The EU-US Data Privacy Framework received an adequacy decision in July 2023 and now supports transfers to certified US organizations. For SCC transfers, assess destination-law risks and add effective supplementary measures where needed. Encryption is not a universal fix: a vendor that must read plaintext may still expose it, even if the customer holds storage keys. Check the recipient’s active DPF participation, covered data and onward-transfer conditions, rather than assuming all US companies qualify.

Some countries impose data localization: certain data must stay in-country. Cloud architecture must respect these rules, so the security team should ask where data is stored, backed up, and administered from.

4.4 Breach notification

Notification depends on the law, entity and breach. Under GDPR, a controller notifies the authority without undue delay and, where feasible, within 72 hours of awareness unless risk to individuals is unlikely; high-risk breaches generally require notice to individuals without undue delay. A processor informs the controller without undue delay, and all personal data breaches must be documented. Under HIPAA, a notifiable breach of unsecured PHI requires individual notice without unreasonable delay and no later than 60 days after discovery; authority/media duties have separate thresholds. Do not treat these limits as permission to wait. The security team's task is to detect fast, preserve evidence, determine scope, and give legal and privacy teams the facts for decisions about notification. Encryption that renders data unreadable can create a safe harbor in some laws.

5. Import/export controls and other obligations

5.1 Import and export restrictions

Some technology cannot cross borders freely. Examples: US Export Administration Regulations (EAR) for dual-use items, ITAR for defense articles and services, and the Wassenaar Arrangement, an agreement among participating states on controls for conventional arms and dual-use goods, which historically included cryptographic items. Practical impacts: a product with strong encryption may need a license or classification before it is shipped abroad, release of controlled technology to foreign persons can trigger deemed-export rules, subject to specific exclusions and authorizations, and sanctions lists restrict dealings with certain countries and parties. Also relevant: some countries restrict the import or use of encryption.

Encryption source code, object code and technology have distinct EAR rules. Public algorithms do not automatically exempt the resulting product, but publicly available software and license exceptions can change obligations. Do not assume every domestic release of encryption source code to a foreign national is a deemed export; classify the actual item, destination, recipient and activity with export counsel.

5.2 Contractual, industry, and regulatory requirements

• Contractual: customer agreements, SLAs, NDAs, and data processing agreements, which can require specific controls, audit rights, and breach notification times.
• Industry standards: the Payment Card Industry Data Security Standard (PCI DSS) is not a law; it is a contractual obligation enforced through card brands and acquiring banks. Scope includes entities handling cardholder/sensitive authentication data and systems that can affect the cardholder data environment. As checked on 27 October 2026, the published standard is PCI DSS v4.0.1; the future-dated v4.x requirements took effect on 31 March 2025.
• Regulatory: laws and rules enforced by agencies (the examples in section 2).

When requirements overlap or conflict (for example, a retention rule that conflicts with a privacy deletion right), involve legal counsel and choose the most protective compliant approach. Document the decision.

5.3 Compliance programs

Build a compliance register that maps obligations to owners and controls, assigns legal review, runs periodic assessments, and records exceptions with expiry dates. Compliance is not security, but compliance is a required floor.

6. Investigation types and evidence

6.1 Types of investigations

6.2 Evidence principles

Evidence may inform internal decisions, while court use additionally depends on applicable admissibility rules, authentication and lawful collection. Relevance and integrity matter, but a court decides admissibility. Key concepts:

• Chain of custody: a documented record of who collected, handled, stored, and transferred each item, when, and why. Gaps can undermine authenticity and evidential weight; they do not automatically make every item inadmissible.
• Types: real (physical) evidence, documentary evidence, testimonial evidence, and demonstrative evidence. Direct evidence proves a fact by itself; circumstantial evidence supports an inference; corroborative evidence supports other evidence; hearsay (out-of-court statements offered for truth) is generally inadmissible, although business records kept in the ordinary course are commonly an exception.
• Originals and duplicates: rules for proving document contents are jurisdiction-specific; authenticated forensic images and accurate duplicates may be acceptable. A hash supports integrity, not lawful acquisition or proof of who performed an action.
• Integrity: document hashes and collection changes; use write blockers for suitable offline media and analyze forensic copies. Live memory or cloud collection needs an authorized method that records unavoidable state changes.
• Order of volatility: prioritize likely value, volatility, retention and collection impact. Memory/process/network state often needs early capture; expiring cloud logs may also be urgent. There is no universal collection sequence independent of safety, authority and incident conditions.
• Legal hold: when litigation is reasonably anticipated, preservation duties apply and routine deletion is suspended.
• Authority to collect: equipment ownership or a login banner does not create unlimited search rights. Counsel must assess employment, privacy, communications and jurisdictional limits. In US federal law, entrapment involves government inducement and lack of predisposition; a private honeypot is not automatically entrapment, but monitoring and decoy operations still require lawful authorization.
• Privacy in investigations: monitoring must be disclosed and proportionate. Banners, signed policies, and works council involvement (where applicable) matter.

6.3 Forensic process (overview)

Identification, preservation, collection, examination, analysis, presentation, and decision. Keep a log, document every action, and limit the number of people who handle evidence. For practical collection and log-preservation methods, continue with investigations and logging operations. Only authorized, trained personnel should collect evidence, because well-meaning administrators often destroy it by rebooting or cleaning systems.

6.4 Worked example: choosing the investigation type

Scenario. A pharmacy chain finds that an administrator copied a customer prescriptions database to a personal cloud storage account three days before resigning to join a competitor. The company wants to know what was taken, stop further harm, recover damages, and possibly punish the person.

Reasoning.

1. Identify possible tracks: an administrative (internal policy) investigation of the policy violation; a civil action for breach of contract and trade secret misappropriation; a criminal complaint for unauthorized access or theft; and regulatory obligations, because prescription data is health-related and the privacy regulator may need to be notified.
2. Immediate action: involve legal counsel, issue a legal hold, and preserve evidence (logs, the administrator's laptop, cloud audit trails) with chain of custody and hashes. Do not confront the former employee or log into their personal account.
3. Counsel coordinates parallel internal, regulatory and litigation tracks; prosecutors decide charges and courts decide outcomes. In a typical US civil claim, the proof standard is lower than criminal proof beyond reasonable doubt. Legal counsel decides the sequence, usually collecting evidence in a way that supports all tracks.
4. Why not simply delete the files at the personal account or ask the employee for a promise? Both would be improper, risk destroying evidence, and would not address notification duties.

7. Security policy, standards, procedures, and guidelines

7.1 The document hierarchy

In this common document hierarchy, policy and standards express requirements, procedures define required steps, and guidelines give recommendations. A baseline is mandatory when adopted by the organization; naming conventions vary, so read scope and enforcement language.

7.2 Policy types

• Regulatory policy: required by law or regulation.
• Advisory policy: strongly suggests behavior, with consequences for ignoring it.
• Informative policy: provides information, not enforced.
• Another classification: enterprise (program) policy (governs the whole security program), issue-specific policy (acceptable use, email, remote access), and system-specific policy (a particular system).

Common policies: information security, acceptable use, data classification and handling, access control, password/authentication, remote work and BYOD, incident response, change management, retention, privacy, vendor management, and AI/acceptable-use of generative tools.

7.3 Writing and maintaining policy

A good policy is clear, short, enforceable, approved at executive level, mapped to business objectives and laws, and communicated. The lifecycle: draft with stakeholders (legal, HR, IT, business), review, approve, publish, train, enforce, measure, review at least annually and after major changes, and retire. Management approval and visible support are essential; policies should state scope, roles, exceptions process, and consequences. Include an exception process with risk acceptance and an expiry date.

7.4 Employee agreements and acknowledgment

New hires sign acceptable-use and confidentiality agreements. Login banners and acknowledgment help establish notice, but do not by themselves establish valid consent or legal monitoring authority. Apply training, employment-law review and proportionate enforcement.

8. Mini case study

Case. Contoso Health, a US telehealth provider, plans to expand to Germany and to use a US-based analytics vendor for patient messages (some from EU residents). It stores card payments for subscriptions. The CISO finds that the retention schedule is undocumented, the acceptable-use policy says "employees should use encryption" with no technical specification, and a sales engineer wants to demonstrate a product containing strong cryptography at a trade show abroad. Two weeks ago, a departing developer was seen copying source code to a personal drive.

Questions.

1. List the legal and contractual regimes that apply.
2. How should EU patient data reach the analytics vendor?
3. What is wrong with the acceptable-use policy statement, and how should the document set be restructured?
4. What should happen about the developer, in which order?
5. What must be checked before the trade show demonstration?

Solution, commented.

1. HIPAA if Contoso is a covered entity and the vendor is its business associate, GDPR for processing in the context of the German establishment or applicable targeting/monitoring criteria, PCI DSS (card data, contractual), and state privacy and breach laws. Exports of cryptographic products may fall under export controls.
2. As a transfer outside the EEA: verify applicable DPF coverage or use an appropriate Article 46 mechanism such as SCCs with a transfer assessment and effective supplementary measures where needed. If the vendor acts only on documented instructions, it is a processor and an Article 28 agreement is required; HIPAA business-associate duties depend on scope. A transfer mechanism does not replace the processing lawful basis or additional health-data conditions. Apply supplier risk assessment and contractual controls.
3. "Should" makes it advisory, and it lacks specifics. Policy must state mandatory intent ("must encrypt confidential data in storage and in transit"), a standard must define algorithms and key lengths, a procedure must describe how to do it, and a guideline may recommend tools. Add scope, roles, exception process, and consequences. Document retention periods too, mapped to law (for example, minimum record retention versus GDPR storage limitation).
4. Treat as a possible trade secret theft with legal counsel: legal hold, evidence preservation with chain of custody, review of agreements and the exit process, decide on administrative action and civil or criminal referral. Do not confront the individual informally or access personal accounts.
5. Whether the product's encryption requires an export classification or license, whether the destination or participants are restricted, and whether technical data will be shared with foreign nationals.

9. Common pitfalls and exam tips

Pitfalls

• Treating PCI DSS as a law. It is an industry contractual standard.
• Believing consent always makes processing lawful; other lawful bases exist and consent must be freely given and withdrawable.
• Thinking policies include steps. Steps belong in procedures; specific technical values belong in standards.
• Forgetting the controller/processor distinction and the contract requirement.
• Believing "hack back" is acceptable.
• Collecting evidence without hashes or custody records, or letting untrained staff "just look around."
• Confusing enticement with entrapment.

Exam tips

• Questions about "first step" in a legal matter: involve legal counsel and preserve evidence.
• Recognize common US proof standards, while checking the claim, forum and jurisdiction; do not assume one universal administrative standard.
• When a scenario mixes jurisdictions, identify all applicable obligations and involve counsel to resolve conflicts; “choose the strictest” is not sufficient when laws are incompatible.
• Trade secret protection depends on reasonable secrecy measures.
• Pick "policy" for high-level management intent, "standard" for mandatory specifics, "procedure" for steps, "guideline" for optional advice, "baseline" for a minimum configuration.
• Time-critical obligations: GDPR 72 hours for authority notification once aware of a notifiable personal data breach.

Key terms

• Chain of custody: documented control of evidence from collection to court.
• Controller / processor: decides purposes and means / processes on instructions.
• Data subject: the individual the personal data relates to.
• Copyright / patent / trademark / trade secret: the four IP protections.
• Adequacy decision, SCCs, BCRs: GDPR transfer mechanisms.
• Preponderance of the evidence / beyond a reasonable doubt: civil and criminal standards of proof.
• Legal hold: order to preserve relevant information.
• Policy / standard / baseline / procedure / guideline: the documentation hierarchy.
• Export controls: laws limiting transfer of sensitive technology abroad.
• Entrapment vs enticement: inducing a crime versus offering an opportunity to someone already inclined.

Summary checklist

• I can distinguish criminal, civil, and administrative law and their burdens of proof.
• I can match a scenario to HIPAA, GLBA, SOX, GDPR, or PCI DSS.
• I know the four IP types and why trade secrets require active protection.
• I can describe controller, processor, data subject, and the main GDPR transfer mechanisms.
• I know the 72-hour GDPR notification rule and that PCI DSS is contractual.
• I can name the five investigation types and describe evidence handling, chain of custody, and order of volatility.
• I can sort a statement into policy, standard, baseline, procedure, or guideline.
• I escalate to legal counsel and preserve evidence before acting in legal matters.

Official sources

• ISC2 CISSP exam outline: https://www.isc2.org/certifications/cissp/cissp-certification-exam-outline (opens in a new tab)
• GDPR text and guidance (European Commission): https://commission.europa.eu/law/law-topic/data-protection_en (opens in a new tab)
• EU-US Data Privacy Framework and transfer safeguards: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en (opens in a new tab)
• PCI Security Standards Council: https://www.pcisecuritystandards.org/ (opens in a new tab)
• HHS HIPAA information: https://www.hhs.gov/hipaa/ (opens in a new tab)
• GDPR territorial scope: https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations/application-gdpr_en (opens in a new tab)
• EDPB breach notification: https://www.edpb.europa.eu/sme/assess-the-risks/data-breaches_en (opens in a new tab)
• HHS breach notification: https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html (opens in a new tab)
• PCI DSS current documents: https://www.pcisecuritystandards.org/document_library/ (opens in a new tab)
• US Courts civil cases: https://www.uscourts.gov/about-federal-courts/types-cases/civil-cases (opens in a new tab)
• NIST forensic guidance: https://csrc.nist.gov/pubs/sp/800/86/final (opens in a new tab)
• BIS encryption licensing: https://www.bis.gov/learn-support/encryption-controls/types-of-licenses (opens in a new tab)
• US federal entrapment elements: https://www.justice.gov/archives/jm/criminal-resource-manual-645-entrapment-elements (opens in a new tab)
• Trade secret protection: https://www.wipo.int/en/web/trade-secrets/protection (opens in a new tab)
• Controller/processor contracts: https://www.edpb.europa.eu/sme/learn-the-basics/data-controller-or-data-processor_en (opens in a new tab)
• GPL licensing FAQ: https://www.gnu.org/licenses/gpl-faq.en.html (opens in a new tab)
• Council of Europe Budapest Convention: https://www.coe.int/en/web/cybercrime/the-budapest-convention (opens in a new tab)