Security and Risk Management · Topic 3 of 7
Legal, Regulatory and Investigation Requirements
Cybercrime and data breaches, intellectual property, import and export controls, transborder data flow, privacy laws and the five CISSP investigation types.
- 4 min
- Copyright protects expression; patents protect inventions; trademarks protect brands; trade secrets stay secret.
- Export controls apply to encryption and dual-use technology.
- Privacy laws limit collection, use and transborder transfer of personal data.
What it is
Security professionals work inside a web of laws, regulations and contracts that differ by country and industry. The exam does not test the text of specific laws in depth; it tests whether you recognize the type of obligation, involve legal counsel and pick the right kind of investigation.
How it works
Cybercrimes and data breaches
Computer crime includes unauthorized access, fraud, malware, denial of service and theft of data. Many jurisdictions require breach notification to regulators and affected people within set time limits. Notification rules depend on where the people live, not only where the company is based.
Intellectual property
| Type | Protects | Notes |
|---|---|---|
| Copyright | Original works of expression, including software code | Automatic on creation; protects expression, not ideas |
| Trademark | Names, logos and symbols that identify a brand | Registered for stronger protection |
| Patent | Inventions that are novel, useful and not obvious | Limited term, public disclosure required |
| Trade secret | Confidential business information | Protected only while kept secret; NDAs and access controls |
| Licensing | Terms of use for software and content | Exceeding licence terms is infringement |
A secret recipe or algorithm kept confidential is a trade secret. Once it leaks without proper protection, the protection can be lost.
Import and export controls
Encryption and other dual-use technologies can be subject to export controls (for example ITAR and EAR in the United States, and the multilateral Wassenaar Arrangement). Moving such technology or data across borders, including to staff abroad, may need a licence.
Transborder data flow and privacy
Privacy laws restrict how personal data is collected, used and transferred. Examples:
| Law (examples) | Region | Key ideas |
|---|---|---|
| GDPR | European Union | Lawful basis, data subject rights, breach notification, limits on transfers outside the EU |
| CCPA / CPRA | California | Consumer rights to know, delete and opt out |
| HIPAA | United States, health data | Privacy and security rules for protected health information |
| PIPL | China | Consent and cross-border transfer rules |
Common privacy principles: collect only what is needed, use it for the stated purpose, keep it accurate and secure, keep it no longer than needed, and respect individuals' rights.
Contractual, legal and industry requirements
Contracts (for example with cloud providers or customers) and industry standards (such as PCI DSS for card data) create obligations as binding in practice as law. Compliance means knowing all of them and mapping controls to each.
Investigation types
| Type | Purpose | Standard of proof (typical) |
|---|---|---|
| Administrative | Internal matters such as policy violations or operational issues | Internal; least formal |
| Criminal | Violations of criminal law, led by law enforcement | Beyond a reasonable doubt |
| Civil | Disputes between parties (contracts, IP) | Preponderance of the evidence |
| Regulatory | Possible violation of regulations, by or for a regulator | Set by the regulator |
| Industry standards | Compliance with standards such as PCI DSS | Set by the standards body or contract |
An investigation can start as administrative and become criminal. Handle evidence carefully from the start so it remains usable if that happens.
How the exam asks about this
- "A confidential formula is protected only by NDAs and access control." Trade secret.
- "An employee broke the acceptable use policy." Administrative investigation.
- "Encryption software is shipped to a staff member abroad." Check export controls.
What to remember for the exam
- Copyright protects expression; patents protect inventions; trademarks protect brands; trade secrets stay secret.
- Export controls apply to encryption and dual-use technology.
- Privacy laws limit collection, use and transborder transfer of personal data.
- Five investigation types: administrative, criminal, civil, regulatory, industry standards.
- Criminal cases need proof beyond a reasonable doubt; civil cases a preponderance of evidence.
Involve legal counsel before deciding on breach notification, law enforcement involvement or cross-border data transfers. These are not purely technical decisions.
Common mistakes
Assuming the company's home country law is the only one. Laws follow the data subjects too.
Treating every incident as criminal. Most start as administrative.
Forgetting evidence handling in investigations that may escalate.
Check yourself
Which form of intellectual property protects a company logo?
A trademark.
Which investigation type uses a preponderance of the evidence as its standard?
A civil investigation.
Why might sending encryption software to an employee in another country need review?
Encryption can be subject to export control laws.
Topic 3 of 7 in Security and Risk Management
Test yourself on Security and Risk Management
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.