CTO CTO Regulatory Compliance & Legal 2 — Questions and Answers
Question 1: What is 'privacy by design' and how should a CTO embed it into the software development lifecycle?
- Integrating data privacy protections into system design from the outset rather than adding them after development (Correct answer)
- Requiring privacy training before any employee can write code
- Installing privacy management software on all developer workstations
- Publishing a privacy policy on the company website
Correct answer: Integrating data privacy protections into system design from the outset rather than adding them after development
Privacy by design means building data minimization, access controls, and privacy protections into systems from the earliest design stage, reducing risk and ensuring regulatory compliance.
Question 2: Under the Americans with Disabilities Act (ADA), what obligation do CTOs have regarding publicly accessible web applications?
- Ensuring web applications meet accessibility standards (WCAG) so people with disabilities can use them (Correct answer)
- Providing in-person technical support for users with disabilities
- Offering discounted pricing for users who require assistive technology
- Hiring a minimum percentage of developers with disabilities
Correct answer: Ensuring web applications meet accessibility standards (WCAG) so people with disabilities can use them
Courts and the DOJ have interpreted the ADA to require that websites and web applications be accessible to people with disabilities, generally measured against WCAG 2.1 AA standards.
Question 3: A CTO discovers that a third-party vendor has suffered a data breach exposing customer PII. Under GDPR, how quickly must the supervisory authority typically be notified?
- Within 72 hours of becoming aware of the breach (Correct answer)
- Within 30 days of discovery
- Within 7 business days
- Only if the breach affects more than 1,000 individuals
Correct answer: Within 72 hours of becoming aware of the breach
GDPR Article 33 requires organizations to notify their supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in risk.
Question 4: Which framework provides a structured approach for US federal agencies and contractors to assess and manage cybersecurity risk and is widely adopted by the private sector?
- NIST Cybersecurity Framework (CSF) (Correct answer)
- ISO 9001
- COBIT 5
- ITIL v4
Correct answer: NIST Cybersecurity Framework (CSF)
The NIST CSF organizes cybersecurity activities into five functions (Identify, Protect, Detect, Respond, Recover) and is widely used by both federal agencies and private enterprises.
Question 5: What is the legal concept of 'intellectual property' most directly relevant to a CTO negotiating a software development contract with an outsourced vendor?
- Work-for-hire clauses that determine ownership of software created by the vendor (Correct answer)
- Non-disclosure agreements protecting trade secrets
- Patent licensing terms for proprietary algorithms
- Open-source license compliance requirements
Correct answer: Work-for-hire clauses that determine ownership of software created by the vendor
Work-for-hire provisions in contracts establish that software created by an external vendor is owned by the company that commissioned it, which is critical to protect product IP.
Question 6: The Payment Card Industry Data Security Standard (PCI DSS) requires specific technical controls. Which technology role is primarily accountable for PCI DSS compliance?
- The CTO or CISO, who must ensure cardholder data environments meet all 12 PCI DSS requirements (Correct answer)
- The CFO, who manages payment processing contracts
- The CMO, who oversees e-commerce transactions
- The legal counsel, who signs the attestation of compliance
Correct answer: The CTO or CISO, who must ensure cardholder data environments meet all 12 PCI DSS requirements
PCI DSS compliance requires implementing technical controls such as network segmentation, encryption, access controls, and monitoring that fall under the CTO/CISO's direct accountability.
CTO CTO Regulatory Compliance & Legal 2
What is 'privacy by design' and how should a CTO embed it into the software development lifecycle?