> ## Documentation Index
> Fetch the complete documentation index at: https://stem-docs.intellectualpoint.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Cybersecurity laws and compliance
> Understand the legal frameworks and industry regulations that govern how organizations protect data.
## Why laws matter in cybersecurity
Building strong defenses is not optional - it is the law. Governments and industry bodies around the world have created regulations that require organizations to protect sensitive data, report breaches, and maintain security standards. If an organization fails to comply, the consequences range from massive fines to criminal charges to losing the ability to do business.
As a cybersecurity professional, understanding these laws is just as important as understanding firewalls and encryption. You cannot protect an organization if you don't know what you are legally required to protect.
Compliance and security are related but different. **Compliance** means meeting the minimum requirements set by a law or regulation. **Security** means actually protecting your systems and data. You can be compliant and still get hacked - compliance is the floor, not the ceiling.
***
## Key regulations
Each regulation below targets a specific type of data or industry. Pay attention to *who* it applies to, *what* it requires, and *what happens* when organizations fail to comply.
### PCI DSS - Payment Card Industry Data Security Standard
PCI DSS is a set of security standards created by the major credit card companies (Visa, Mastercard, American Express, Discover, JCB) to protect cardholder data. It is not a government law - it is an industry standard enforced through contracts between merchants, banks, and card networks.
If your business accepts credit or debit card payments, PCI DSS applies to you. Period.
**Any business that processes, stores, or transmits credit/debit card data.** This includes:
* Retail stores (in-person and online)
* Restaurants and food service
* E-commerce websites
* Payment processors
* Any company with a point-of-sale (POS) system
**Donuts & Dragons connection:** Their POS system processes credit and debit card transactions every day. That means Donuts & Dragons **must** comply with PCI DSS - no exceptions.
PCI DSS has **12 core requirements** organized into six categories:
| Category | Requirements |
| ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| Build and maintain a secure network | Install and maintain firewalls; don't use vendor-supplied default passwords |
| Protect cardholder data | Encrypt stored card data; encrypt transmission of card data across public networks |
| Maintain a vulnerability management program | Use and regularly update antivirus; develop and maintain secure systems and applications |
| Implement strong access controls | Restrict access to cardholder data on a need-to-know basis; assign unique IDs to each user; restrict physical access |
| Regularly monitor and test networks | Track and monitor all access to network resources and cardholder data; regularly test security systems |
| Maintain an information security policy | Create and maintain a security policy for all personnel |
PCI DSS non-compliance can result in:
* **Fines of $5,000 to $100,000 per month** until compliance is achieved
* **Increased transaction fees** from payment processors
* **Loss of the ability to process card payments** - this can shut down a business entirely
* **Liability for fraud losses** if a breach occurs while non-compliant
Imagine Donuts & Dragons loses the ability to accept credit cards. In a world where most customers pay with cards, that could effectively close the business. PCI DSS compliance is not optional - it is survival.
***
### GDPR - General Data Protection Regulation
GDPR is a comprehensive data protection law passed by the European Union in 2018. It is widely considered the strongest data privacy regulation in the world and has influenced privacy laws globally.
GDPR gives individuals control over their personal data and imposes strict obligations on organizations that collect, process, or store that data.
**Any organization that handles the personal data of EU citizens** - regardless of where the organization is located. This means:
* A company in Virginia that sells products online to customers in France must comply with GDPR
* A mobile app developed in California that has users in Germany must comply with GDPR
* If Donuts & Dragons ever opens an online store and ships to Europe, GDPR applies
This extraterritorial reach is what makes GDPR so powerful.
| Requirement | What it means |
| --------------------------------- | ---------------------------------------------------------------------------------------------------- |
| **Consent** | You must get clear, explicit consent before collecting personal data. Pre-checked boxes don't count. |
| **Right to access** | Individuals can request a copy of all data you hold about them |
| **Right to be forgotten** | Individuals can request that you delete all their personal data |
| **Data breach notification** | You must report a breach to regulators **within 72 hours** of discovery |
| **Data Protection Officer (DPO)** | Organizations that process large amounts of personal data must appoint a dedicated DPO |
| **Privacy by design** | Data protection must be built into systems from the start, not bolted on later |
| **Data minimization** | Only collect the data you actually need - nothing more |
GDPR penalties are among the harshest in the world:
* **Up to 4% of global annual revenue** or **€20 million** - whichever is greater
* In 2023, Meta (Facebook) was fined **€1.2 billion** for GDPR violations related to data transfers
* Amazon was fined **€746 million** in 2021
These are not theoretical numbers. GDPR regulators actively enforce the law and have issued billions of euros in fines since 2018.
***
### HIPAA - Health Insurance Portability and Accountability Act
HIPAA is a U.S. federal law that protects the privacy and security of patient health information. Passed in 1996, it establishes national standards for how healthcare organizations handle protected health information (PHI).
If you have ever visited a doctor's office and signed a privacy notice, that was HIPAA in action.
HIPAA applies to **covered entities** and their **business associates**:
* **Covered entities:** Hospitals, clinics, doctors, dentists, pharmacies, health insurance companies
* **Business associates:** Any company that handles PHI on behalf of a covered entity - cloud providers, billing companies, IT support firms, shredding services
If Donuts & Dragons partnered with a healthcare company and handled any employee health data, HIPAA rules would apply to that data.
HIPAA has three main rules:
| Rule | Requirements |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Privacy Rule** | Defines what PHI is and who can access it. Patients have the right to see their records and request corrections. |
| **Security Rule** | Requires technical, administrative, and physical safeguards to protect electronic PHI (ePHI). Includes access controls, encryption, audit trails, and employee training. |
| **Breach Notification Rule** | Requires notification to affected individuals, the HHS (Department of Health and Human Services), and sometimes the media if a breach affects 500+ people. |
HIPAA violations are tiered based on the level of negligence:
| Tier | Description | Penalty per violation | Annual maximum |
| ---- | ----------------------------------------- | --------------------- | -------------- |
| 1 | Didn't know and couldn't have known | $100 - $50,000 | \$25,000 |
| 2 | Reasonable cause, not willful neglect | $1,000 - $50,000 | \$100,000 |
| 3 | Willful neglect, corrected within 30 days | $10,000 - $50,000 | \$250,000 |
| 4 | Willful neglect, not corrected | \$50,000 | \$1,500,000 |
Criminal violations can result in **up to 10 years in prison**.
HIPAA is not just about fines. Healthcare breaches make national news, destroy patient trust, and can result in criminal prosecution of individuals - not just the organization.
***
### ISO 27701 - Privacy Information Management
ISO 27701 is an international standard that provides a framework for managing privacy information. It extends **ISO 27001** (the global standard for information security management systems) by adding privacy-specific controls.
Unlike PCI DSS, GDPR, and HIPAA, ISO 27701 is a **voluntary** standard. Organizations choose to adopt it to demonstrate their commitment to privacy and to align with regulatory requirements worldwide.
Any organization that wants to:
* Demonstrate privacy management compliance to customers, partners, or regulators
* Build a formal Privacy Information Management System (PIMS)
* Align their privacy practices with multiple regulations (GDPR, HIPAA, etc.) using a single framework
* Achieve certification through an independent audit
ISO 27701 is especially popular with technology companies, cloud providers, and organizations that operate in multiple countries and need to comply with various privacy laws simultaneously.
ISO 27701 provides guidance for:
| Area | Focus |
| -------------------------- | ---------------------------------------------------------------------------------------------------------- |
| **PII controllers** | Organizations that determine why and how personal data is processed |
| **PII processors** | Organizations that process personal data on behalf of controllers |
| **Risk assessment** | Identify and assess privacy risks specific to personal data |
| **Privacy controls** | Implement controls for consent management, data subject rights, data retention, and cross-border transfers |
| **Continuous improvement** | Regular audits, reviews, and updates to the privacy management system |
While non-compliance doesn't carry government fines (since it's voluntary), the benefits of ISO 27701 include:
* **Competitive advantage:** Certification demonstrates privacy maturity to customers and partners
* **Regulatory alignment:** Maps to GDPR, HIPAA, and other regulations, simplifying compliance
* **Risk reduction:** Structured framework reduces the likelihood of privacy incidents
* **Trust building:** Independent certification provides third-party validation of your practices
***
## Key legal concepts
Beyond specific regulations, there are foundational legal concepts that every cybersecurity professional needs to understand.
### Personally Identifiable Information (PII)
**PII** is any data that can be used to identify a specific individual, either on its own or when combined with other data.
Data that identifies someone on its own:
* Full name
* Social Security number (SSN)
* Driver's license number
* Passport number
* Email address
* Phone number
* Biometric data (fingerprints, facial recognition)
Data that can identify someone when combined with other information:
* Date of birth
* ZIP code
* Gender
* Job title
* IP address
* Device identifiers
Research has shown that **87% of Americans** can be uniquely identified using just three data points: ZIP code, date of birth, and gender. Data that seems harmless in isolation can become PII when combined.
### Data breach notification laws
Most U.S. states - and many countries - require organizations to notify affected individuals when their personal data is compromised. Key points:
* **All 50 U.S. states** have data breach notification laws (though the specific requirements vary)
* Notification timelines range from **30 to 90 days** depending on the state
* Many laws require notification to the **state attorney general** in addition to affected individuals
* Some states require offering **free credit monitoring** to affected individuals
* GDPR requires notification to regulators within **72 hours**
There is currently no single federal data breach notification law in the United States. This means organizations operating in multiple states must track and comply with each state's individual requirements.
### Duty of care
**Duty of care** is the legal obligation for organizations to take reasonable steps to protect the data entrusted to them. If an organization is negligent - for example, storing passwords in plain text or ignoring known vulnerabilities - they can be held legally liable for damages resulting from a breach.
Courts evaluate whether an organization met its duty of care by asking:
* Did they follow industry-standard security practices?
* Did they address known vulnerabilities in a timely manner?
* Did they have an incident response plan?
* Did they train their employees on security awareness?
***
## Compliance and the CIA Triad
Remember the **CIA Triad** from Day 1? Every regulation you've learned about today maps directly back to confidentiality, integrity, and availability.
| Regulation | Confidentiality | Integrity | Availability |
| ------------- | ---------------------------------------------- | ------------------------------------------- | ------------------------------------------ |
| **PCI DSS** | Encrypt cardholder data, restrict access | Protect data from unauthorized modification | Ensure payment systems remain operational |
| **GDPR** | Consent-based data collection, access controls | Right to correction, data accuracy | Right to access, system availability |
| **HIPAA** | Protect PHI from unauthorized disclosure | Audit trails, data accuracy requirements | Ensure patient access to health records |
| **ISO 27701** | Privacy controls for PII | Data quality and accuracy management | Availability of privacy management systems |
When someone asks "why do we need this security control?" - the answer almost always connects back to compliance, the CIA Triad, or both. Security controls are not random - they exist to meet specific legal and security requirements.
***
## Exercise: compliance at Donuts & Dragons
Apply what you have learned to your Donuts & Dragons donut shop.
Think about what Donuts & Dragons does every day. Which of the four regulations you learned about today apply to them, and why?
**Answer:**
* **PCI DSS** - Donuts & Dragons processes credit and debit card payments through their POS system every day. They must comply with PCI DSS.
* **GDPR** - If they collect any data from EU citizens (for example, through an online ordering system or loyalty program), GDPR applies.
* **HIPAA** - Probably does not apply unless they handle employee health information in a way that brings them under HIPAA's scope. A small donut shop is unlikely to be a HIPAA covered entity.
* **ISO 27701** - Voluntary, but adopting it would demonstrate maturity and could help them meet PCI DSS and GDPR requirements more systematically.
List all the types of PII that Donuts & Dragons might collect and store.
**Consider:**
* Customer data from card transactions
* Employee records (payroll, SSN, addresses)
* Loyalty program data (if they have one)
* Security camera footage (contains faces - biometric data)
* Wi-Fi connection logs (IP addresses, device IDs)
Look at the security controls available in the wargame. Which ones help Donuts & Dragons comply with PCI DSS?
**Think about:**
* POS Security Suite → Protects cardholder data (PCI DSS requirements 3 and 4)
* Cloud Backups → Supports availability and disaster recovery
* Antivirus → Maintains secure systems (PCI DSS requirement 5)
* Security Awareness Training → Maintains a security policy for all personnel (PCI DSS requirement 12)
* Separate Guest WiFi → Segments the network to protect the POS system (PCI DSS requirement 1)
***
## Key takeaways
Regulations are not suggestions. Non-compliance leads to fines, lawsuits, and loss of business - sometimes all three.
You cannot protect what you don't know you have. Identify all PII in your organization and map it to applicable regulations.
The security controls you learned this week - encryption, access controls, monitoring, training - are the same controls that regulations require.
New privacy laws are being passed every year worldwide. Cybersecurity professionals must stay current with the legal landscape.