Legal Framework & Constitutional Law Flashcards

Which federal law requires critical infrastructure operators in certain sectors to report significant cybersecurity incidents to CISA within 72 hours of reasonable belief that a covered incident has occurred?

Answer: Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA 2022)

CIRCIA (2022) directs CISA to develop rules requiring covered critical infrastructure entities to report significant cyber incidents within 72 hours and ransomware payments within 24 hours.

Under the Federal Rules of Civil Procedure (FRCP), electronically stored information (ESI) that must be preserved when litigation is reasonably anticipated is protected by which legal obligation?

Answer: Litigation hold (legal hold)

A litigation hold (also called a legal hold) is the duty to preserve potentially relevant ESI and documents once litigation is reasonably anticipated, preventing spoliation.

A cybersecurity professional conducting a penetration test discovers evidence of a crime unrelated to the authorized assessment. Under common law, the most appropriate first action is:

Answer: Stop the assessment and notify the client per the engagement agreement

When unexpected criminal evidence is found during an authorized pen test, the professional should stop relevant testing and notify the client per the engagement agreement's scope and legal reporting clauses.

Which doctrine provides a safe harbor for good-faith security researchers who access systems to identify and report vulnerabilities, and was the basis for DOJ policy guidance issued in 2022?

Answer: Good-faith security research exemption under CFAA charging policy

DOJ's 2022 CFAA charging policy memo states that good-faith security research conducted to improve defenses should not be prosecuted, though this is policy guidance, not a statutory safe harbor.

State breach notification laws in the U.S. generally require notification to affected residents when which type of data is compromised?

Answer: Defined combinations of personal information such as name plus SSN, driver's license, or financial account numbers

State breach notification laws typically trigger when a defined combination of personal data elements (e.g., name plus SSN, financial account, or driver's license number) is compromised.

The principle that organizations should collect only the minimum personal data necessary to fulfill a specific purpose is known as:

Answer: Data minimization

Data minimization is the privacy-by-design principle requiring that only data strictly necessary for the stated purpose be collected, embodied in GDPR Article 5(1)(c) and many other frameworks.

Under FISMA (Federal Information Security Modernization Act of 2014), which agency is responsible for developing federal information security standards and guidelines for non-national-security systems?

Answer: National Institute of Standards and Technology (NIST)

FISMA designates NIST as the agency responsible for developing cybersecurity standards, guidelines, and recommendations (such as the NIST SP 800 series) for federal non-national-security systems.