CTO Regulatory Compliance & Legal Flashcards

What is 'privacy by design' and how should a CTO embed it into the software development lifecycle?

Answer: Integrating data privacy protections into system design from the outset rather than adding them after development

Privacy by design means building data minimization, access controls, and privacy protections into systems from the earliest design stage, reducing risk and ensuring regulatory compliance.

Under the Americans with Disabilities Act (ADA), what obligation do CTOs have regarding publicly accessible web applications?

Answer: Ensuring web applications meet accessibility standards (WCAG) so people with disabilities can use them

Courts and the DOJ have interpreted the ADA to require that websites and web applications be accessible to people with disabilities, generally measured against WCAG 2.1 AA standards.

A CTO discovers that a third-party vendor has suffered a data breach exposing customer PII. Under GDPR, how quickly must the supervisory authority typically be notified?

Answer: Within 72 hours of becoming aware of the breach

GDPR Article 33 requires organizations to notify their supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in risk.

Which framework provides a structured approach for US federal agencies and contractors to assess and manage cybersecurity risk and is widely adopted by the private sector?

Answer: NIST Cybersecurity Framework (CSF)

The NIST CSF organizes cybersecurity activities into five functions (Identify, Protect, Detect, Respond, Recover) and is widely used by both federal agencies and private enterprises.

What is the legal concept of 'intellectual property' most directly relevant to a CTO negotiating a software development contract with an outsourced vendor?

Answer: Work-for-hire clauses that determine ownership of software created by the vendor

Work-for-hire provisions in contracts establish that software created by an external vendor is owned by the company that commissioned it, which is critical to protect product IP.

The Payment Card Industry Data Security Standard (PCI DSS) requires specific technical controls. Which technology role is primarily accountable for PCI DSS compliance?

Answer: The CTO or CISO, who must ensure cardholder data environments meet all 12 PCI DSS requirements

PCI DSS compliance requires implementing technical controls such as network segmentation, encryption, access controls, and monitoring that fall under the CTO/CISO's direct accountability.