Chapter 4 - CISSP Domain 1 - Laws, Regulations and Compliance

Chapter 4 - CISSP Domain 1 - Laws, Regulations and Compliance

1. 3 main categories of Law

   • Criminal Law
   • Civil Law
   • Administrative Law

2. Intellectual Property

   • 1998
     • Digital Millennium Copyright Act
   • 2015
     • Anti Counterfeiting Trade Agreement
   • Trademarks
     • Protects name / slogan to avoid confusion
   • Patents
     • Inventions
     • Public after 20 y.
   • Trade Secrets
     • Unregistered kept secrets
   • 1996
     • Economic Espionage Act
   • Copyright
     • Protects creative works

3. Computer Crime / Cyber Security

   • 1984
     • 1st. Computer crime law enacted as part of Comprehensive Crime Control Act
   • 1986
     • Computer Fraud Abuse Act
   • 1994
     • Computer Abuse Amendments Act
   • 1987
     • Computer Security Act
   • 1991
     • Federal Sentencing Guidelines
   • 1996
     • National Information Infrastructure Protection Act
   • 1995
     • Paperwork Reduction Act
   • 2000
     • Government Information Security Reform Act
   • 2002
     • Federal Information Security Management Act

4. Privacy

   • PII / Personal Identifiable Information
   • Fourth Amendment of the U.S Constitution
   • 1974
     • Privacy Act
   • 1986
     • Electronic Communication Privacy Act
   • 1994
     • Communication Assistance for Law Enforcement Act
   • 1996
     • Economic and Protection of Proprietary Information Act
     • Health Insurance Portability and Accountability Act
   • 2009
     • Health Information Technology for Economic and Clinical Health Act
   • 1998
     • Children's Online Privacy Protection Act
     • Identity Theft and Assumption Deterrence Act
   • 1999
     • Gramm-Leach-Bliley Act
   • 2001
     • USA PATRIOT Act
   • Family Educational Rights and Privacy Act
   • EU 1995
     • Directive to Privacy Law for personal data on information systems

5. Licensing

   • Shrink-wraps / break is agree
   • Click-through / during installs
   • Cloud Service License Agreements
   • Contractual License Agreement

6. Import / Export

   • Encryption Export Control
     • 30 day review
   • Computer Export Control
     • Exceptions apply on basis of nuclear or terrorism threat

7. Compliance

8. Contracting and Procurement