Compliance (Law and Regulations) in Cybersecurity Engineering

Vocabulary practice flashcards covering compliance, cybersecurity regulations, federal and state privacy statutes, Safe Harbor provisions, and notable cybersecurity legal cases.

Personally Identifiable Information (PII)

Information that can be used to distinguish or trace an individual's identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.

California Senate Bill 1386

A landmark state breach notification law that mandates reporting the unauthorized release of unencrypted personal information belonging to any California resident.

Data Disposal Laws

State statutes enacted in at least 32 states (excluding Virginia) that specify legal requirements and methods for properly cleaning or destroying sensitive and confidential data.

General Data Protection Regulation (GDPR)

An EU regulation adopted in 2016 and enforceable on 25 May 2018 that covers personal data across private, professional, or public life, including a requirement to notify authorities of a data breach within 72 hours.

Network & Information Security (NIS) Directive

An EU directive passed in 2016 aimed at boosting the overall level of cybersecurity in the European Union, requiring member states to transpose it into national laws and identify essential service operators by 2018.

Federal Trade Commission (FTC)

A United States agency active since the 1970s focused on consumer protection laws to prevent fraud, deception, and unfair business practices, while actively handling data breaches, privacy violations, and social engineering scams.

NIST Cybersecurity Framework

A set of guidelines, rules, and standards created by the National Institute of Standards and Technology to boost overall organizational cybersecurity across core functions: Govern, Identify, Protect, Detect, Respond, and Recover.

Safe Harbor

Legal provisions that reduce or eliminate breach notification requirements, fines, or legal liabilities for organizations if proactive security measures—most commonly proper data encryption—are in place.

Virginia Breach Notification Statute

A state law providing that the unauthorized acquisition of encrypted or redacted data does not trigger a breach notification requirement, provided the unauthorized party lacks access to the encryption key.

Privacy Act of 1974

A federal law that governs the collection, maintenance, use, and dissemination of personally identifiable information about individuals stored by federal agencies.

Health Insurance Portability and Accountability Act (HIPAA)

A federal statute enacted in 1996 designed to safeguard and protect the confidentiality and security of medical records.

Fair Credit Reporting Act (FCRA)

A federal act that grants consumers legal rights and protections regarding the use, privacy, and accuracy of their credit information.

Electronic Communications Privacy Act

A federal law used to impose criminal sanctions on any individual or entity that intercepts wire, oral, or electronic communications without proper consent.

Children's Online Privacy Protection Act (COPPA)

A 1998 federal law requiring websites directed at children under the age of 13 to obtain verifiable parental consent before collecting personal data, though widely criticized as ineffective.

Cyber Law

The legal framework that protects users, organizations, and governments online, encompassing privacy, intellectual property, cybercrime, e-commerce, internet governance, and liability.

Mark Abene (Phiber Optik)

An early hacker born in 1972 associated with the Legion of Doom (LOD) and Masters of Deception (MOD) who targeted phone systems and dial-up connections, becoming the first subject of data-related wiretap prosecution and serving one year until release in 1994.

Vladimir Drinkman

A hacker indicted in 2009 under Title 18, USC Section 371 for credit card theft and SQL injection attacks against major corporations (such as NASDAQ and 7 Eleven), who was arrested in the Netherlands in 2012, extradited in 2015, and sentenced to 12 years in February 2018.

Edward Snowden

A former intelligence contractor charged with Espionage who disclosed 50,000 to 200,000 (and potentially up to 1.7 million) classified documents to media outlets in 2013 regarding global surveillance operations before seeking refuge in Russia.