Skip to main content

​
Why laws matter in cybersecurity

Building strong defenses is not optional - it is the law. Governments and industry bodies around the world have created regulations that require organizations to protect sensitive data, report breaches, and maintain security standards. If an organization fails to comply, the consequences range from massive fines to criminal charges to losing the ability to do business. As a cybersecurity professional, understanding these laws is just as important as understanding firewalls and encryption. You cannot protect an organization if you don’t know what you are legally required to protect.
Compliance and security are related but different. Compliance means meeting the minimum requirements set by a law or regulation. Security means actually protecting your systems and data. You can be compliant and still get hacked - compliance is the floor, not the ceiling.

​
Key regulations

Each regulation below targets a specific type of data or industry. Pay attention to who it applies to, what it requires, and what happens when organizations fail to comply.

​
PCI DSS - Payment Card Industry Data Security Standard

PCI DSS is a set of security standards created by the major credit card companies (Visa, Mastercard, American Express, Discover, JCB) to protect cardholder data. It is not a government law - it is an industry standard enforced through contracts between merchants, banks, and card networks.If your business accepts credit or debit card payments, PCI DSS applies to you. Period.

​
GDPR - General Data Protection Regulation

GDPR is a comprehensive data protection law passed by the European Union in 2018. It is widely considered the strongest data privacy regulation in the world and has influenced privacy laws globally.GDPR gives individuals control over their personal data and imposes strict obligations on organizations that collect, process, or store that data.

​
HIPAA - Health Insurance Portability and Accountability Act

HIPAA is a U.S. federal law that protects the privacy and security of patient health information. Passed in 1996, it establishes national standards for how healthcare organizations handle protected health information (PHI).If you have ever visited a doctor’s office and signed a privacy notice, that was HIPAA in action.

​
ISO 27701 - Privacy Information Management

ISO 27701 is an international standard that provides a framework for managing privacy information. It extends ISO 27001 (the global standard for information security management systems) by adding privacy-specific controls.Unlike PCI DSS, GDPR, and HIPAA, ISO 27701 is a voluntary standard. Organizations choose to adopt it to demonstrate their commitment to privacy and to align with regulatory requirements worldwide.
Beyond specific regulations, there are foundational legal concepts that every cybersecurity professional needs to understand.
Slide explaining PII and PHI examples and the distinction between data privacy and data security

Understanding PII, PHI, and the difference between data privacy and data security

​
Personally Identifiable Information (PII)

PII is any data that can be used to identify a specific individual, either on its own or when combined with other data.
Data that identifies someone on its own:
  • Full name
  • Social Security number (SSN)
  • Driver’s license number
  • Passport number
  • Email address
  • Phone number
  • Biometric data (fingerprints, facial recognition)
Data that can identify someone when combined with other information:
  • Date of birth
  • ZIP code
  • Gender
  • Job title
  • IP address
  • Device identifiers
Research has shown that 87% of Americans can be uniquely identified using just three data points: ZIP code, date of birth, and gender. Data that seems harmless in isolation can become PII when combined.

​
Data breach notification laws

Most U.S. states - and many countries - require organizations to notify affected individuals when their personal data is compromised. Key points:
  • All 50 U.S. states have data breach notification laws (though the specific requirements vary)
  • Notification timelines range from 30 to 90 days depending on the state
  • Many laws require notification to the state attorney general in addition to affected individuals
  • Some states require offering free credit monitoring to affected individuals
  • GDPR requires notification to regulators within 72 hours
There is currently no single federal data breach notification law in the United States. This means organizations operating in multiple states must track and comply with each state’s individual requirements.

​
Duty of care

Duty of care is the legal obligation for organizations to take reasonable steps to protect the data entrusted to them. If an organization is negligent - for example, storing passwords in plain text or ignoring known vulnerabilities - they can be held legally liable for damages resulting from a breach. Courts evaluate whether an organization met its duty of care by asking:
  • Did they follow industry-standard security practices?
  • Did they address known vulnerabilities in a timely manner?
  • Did they have an incident response plan?
  • Did they train their employees on security awareness?

​
Compliance and the CIA Triad

Remember the CIA Triad from Day 1? Every regulation you’ve learned about today maps directly back to confidentiality, integrity, and availability.
When someone asks “why do we need this security control?” - the answer almost always connects back to compliance, the CIA Triad, or both. Security controls are not random - they exist to meet specific legal and security requirements.

​
Exercise: compliance at Donuts & Dragons

Apply what you have learned to your Donuts & Dragons donut shop.
Think about what Donuts & Dragons does every day. Which of the four regulations you learned about today apply to them, and why?Answer:
  • PCI DSS - Donuts & Dragons processes credit and debit card payments through their POS system every day. They must comply with PCI DSS.
  • GDPR - If they collect any data from EU citizens (for example, through an online ordering system or loyalty program), GDPR applies.
  • HIPAA - Probably does not apply unless they handle employee health information in a way that brings them under HIPAA’s scope. A small donut shop is unlikely to be a HIPAA covered entity.
  • ISO 27701 - Voluntary, but adopting it would demonstrate maturity and could help them meet PCI DSS and GDPR requirements more systematically.
List all the types of PII that Donuts & Dragons might collect and store.Consider:
  • Customer data from card transactions
  • Employee records (payroll, SSN, addresses)
  • Loyalty program data (if they have one)
  • Security camera footage (contains faces - biometric data)
  • Wi-Fi connection logs (IP addresses, device IDs)
Look at the security controls available in the wargame. Which ones help Donuts & Dragons comply with PCI DSS?Think about:
  • POS Security Suite → Protects cardholder data (PCI DSS requirements 3 and 4)
  • Cloud Backups → Supports availability and disaster recovery
  • Antivirus → Maintains secure systems (PCI DSS requirement 5)
  • Security Awareness Training → Maintains a security policy for all personnel (PCI DSS requirement 12)
  • Separate Guest WiFi → Segments the network to protect the POS system (PCI DSS requirement 1)

​
Key takeaways

Compliance is mandatory

Regulations are not suggestions. Non-compliance leads to fines, lawsuits, and loss of business - sometimes all three.

Know your data

You cannot protect what you don’t know you have. Identify all PII in your organization and map it to applicable regulations.

Security enables compliance

The security controls you learned this week - encryption, access controls, monitoring, training - are the same controls that regulations require.

Laws keep evolving

New privacy laws are being passed every year worldwide. Cybersecurity professionals must stay current with the legal landscape.