1. There are four main types of compliance obligations that security professionals must be familiar with:
   1. Criminal Law
      1. Laws designed to:
         1. Deter actions that would be detrimental to society
         2. Punish those who take such actions
      2. Criminal offenses include:
         1. Murder
         2. Robbery
         3. Hacking
         4. Insider Trading
         5. Espionage
      3. Criminal laws must be created by a legislative government body.
      4. Criminal laws share one important characteristic, not found in any other type of law:
         1. Violations of criminal law may be punished with the Deprivation of Liberty:
            1. Probation
            2. Incarceration
            3. Capital Punishment
   2. Civil Law
      1. Laws designed to resolve disputes.
      2. Civil laws cover almost any matter not addressed by criminal law, including:
         1. Liability Claims
         2. Estate Probation
         3. Contractual Disputes
      3. As with criminal laws, civil laws must be passed by a legislative body.
      4. Civil laws cannot be punished by the Deprivation of Liberty.
      5. The most common outcomes of a successful civil lawsuit are:
         1. Monetary damages
         2. Orders by the court that a party refrain from an action.
   3. Administrative Law
      1. Laws designed to allow government agencies to operate effectively. Agencies accomplish this by promulgating (putting into effect) regulations to affect existing laws.
      2. Administrative Regulations facilitate an agency as it carries out its duties, by providing:
         1. Clarifying details missing from the original law.
         2. Procedural rules, outlining the operation of government, or parties over which government has authority, in specific instances.
      3. Example: HIPAA
         1. The Health Insurance Portability and Accountability Act
         2. The original law governs the uses of health information in these two realms of law:
            1. Criminal Law
            2. Civil Law
         3. The Centers for Medicare and Medicaid Services publishes security and privacy regulations that provide the specific requirements that covered entities must follow. Those security and privacy regulations are an example of:
            1. Administrative Law
      4. At the federal level, administrative law is found in the Code of Federal Regulations (CFR).
   4. Private Regulations
      1. Private Regulations are not laws issued by a single sovereign nation. Instead, trade groups for a specific industry agree on standards and practices to be met.
      2. Compliance with private regulations are enforced through civil law, typically citing the civil laws of the nation in which the contract was created, and the nations in which the business took place. These terms are defined in the contract.
      3. Example: PCI DSS
         1. Payment Card Industry Data Security Standard
         2. PCIDSS was created by a consortium of companies without the involvement of a government agency.
         3. In order to accept and process payment cards (Debit and/or Credit Cards), businesses must sign a contract, stating their willingness to comply with the terms of PCIDSS.
2. Cyber Security and Constitutional Law:
   1. The Fourth Amendment:
      1. The most common intersection between information security professionals and United States Constitutional Law occurs due to conflicts involving the Fourth Amendment
      2. Part of the Bill of Rights, the Fourth Amendment reads, "the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated".
      3. The Fourth Amendment protects citizens in cases where government agents, including law enforcement officers, wish to collect private information from computer systems without the information owner's consent.
      4. Evidence obtained without a warrant violates the Fourth Amendment, and is inadmissible in court.
   2. FISMA:
      1. The Federal information Security Management Act
      2. FISMA governs information security matters for federal agencies and government contractors:
         1. Requires the creation of security programs throughout the federal government.
         2. Provides details on the controls necessary to run information systems. Controls are categorized as:
            1. FISMA High
            2. FISMA Moderate
            3. FISMA Low