CSL CSL Legal, Regulatory & Ethical Considerations 2

Question 1

What is GDPR's relevance to US-based organizations?

Accepted Answer

Organizations processing personal data of EU residents must comply with GDPR regardless of where the organization is based

Answer

GDPR applies based on where data subjects (individuals) are located, not where the organization is based — US companies with EU customers or website visitors must comply.

Question 2

What is the legal concept of 'negligence' in the context of cybersecurity liability?

Accepted Answer

Failure to implement reasonable security measures that a prudent organization in the same industry would have adopted

Answer

Cybersecurity negligence claims arise when organizations fail to implement security controls considered reasonable and standard for their industry, and a breach results from that failure.

Question 3

Which US federal law requires financial institutions to implement a written information security program?

Accepted Answer

The Gramm-Leach-Bliley Act (GLBA) Safeguards Rule

Answer

The GLBA Safeguards Rule requires financial institutions to develop, implement, and maintain a comprehensive written information security program protecting customer financial data.

Question 4

What is the purpose of an 'acceptable use policy (AUP)' from a legal and ethical standpoint?

Accepted Answer

Define permitted and prohibited uses of organizational systems, establishing a legal basis for enforcement actions

Answer

An AUP establishes clear, documented rules for system use, creating the legal and ethical basis for monitoring, enforcement, and disciplinary action when violations occur.

Question 5

A CSL leader is asked to authorize an offensive security test against a partner organization's system. What is the primary legal concern?

Accepted Answer

Without explicit written authorization from the target organization, the test may violate the CFAA regardless of business relationships

Answer

The CFAA prohibits unauthorized computer access — even well-intentioned security testing requires explicit written authorization from the system owner to be legally protected.

(CSL) Cybersecurity Leadership Certification Practice Test

(CSL) Cybersecurity Leadership Certification Practice Test

CSL CSL Legal, Regulatory & Ethical Considerations 2