Foundations of Cyber Law, Risk and Governance

Introduction

Modern organisations depend on digital systems to deliver services, store records, communicate with customers and make decisions. This dependence creates value, but it also creates exposure. A stolen password may disclose personal information; a manipulated database record may cause an incorrect payment; and an unavailable cloud service may interrupt essential operations. These are not merely technical problems. They may involve legal duties, contractual obligations, ethical responsibilities, financial loss and damage to public trust.

Cybersecurity therefore operates within three connected dimensions:

1. Law establishes enforceable rules and remedies.
2. Risk management helps an organisation understand uncertainty and select proportionate safeguards.
3. Governance determines who has authority, responsibility and accountability for cybersecurity decisions.

This chapter introduces the vocabulary and conceptual foundations needed to study cyber law, risk management and security governance. Because laws differ between countries and may change over time, the chapter explains general principles rather than providing legal advice for a particular jurisdiction.

Learning Objectives

After completing this chapter, a learner should be able to:

• explain cyberspace and identify information assets;
• apply the confidentiality, integrity and availability model;
• explain accountability and its relationship to responsibility;
• distinguish laws, regulations, standards, policies and ethics;
• describe legal systems, jurisdiction and applicable law;
• explain due care, due diligence, governance, risk and compliance;
• identify common legal and governance issues in a cyber incident; and
• recommend appropriate foundational actions for an organisation.

1. Cyberspace and Information Assets

1.1 Meaning of cyberspace

Cyberspace is the interconnected environment formed by information and communication technologies, the data they process, the people who use them and the social, economic and institutional activities supported by them. It includes networks, computers, mobile devices, cloud platforms, industrial control systems, applications, digital identities and communications. It is not limited to the public internet.

A useful way to understand cyberspace is as a socio-technical environment. The technical layer includes hardware, software, networks and protocols. The human and organisational layer includes users, administrators, suppliers, business processes, laws, contracts and cultural expectations. A technically secure system can still be compromised by an employee who discloses credentials or by a supplier whose access is poorly controlled.

Cyberspace has several characteristics that complicate governance:

• Interconnection: a weakness in one system may affect many others.
• Speed: attacks and data transfers can occur across borders within seconds.
• Scale: one automated action can affect millions of records or devices.
• Persistence: copied data may remain available even after the original is deleted.
• Attribution difficulty: identifying the person or group responsible for an incident may be difficult.
• Jurisdictional complexity: systems, users, victims and service providers may be located in different countries.

1.2 Information assets

An information asset is information, or a resource that supports the creation, processing, storage, transmission or protection of information, and that has value to an organisation or other stakeholder. Examples include:

• customer identity and payment data;
• employee records and payroll information;
• source code, algorithms and intellectual property;
• financial statements and business plans;
• databases, servers, laptops and mobile devices;
• cloud services and application programming interfaces;
• cryptographic keys, passwords and security logs; and
• business processes and the availability of essential services.

Asset value is not determined only by purchase price. A database may have modest replacement cost but enormous value because of the information it contains, the legal obligations attached to it or the consequences of its unavailability. Asset classification should therefore consider sensitivity, criticality, ownership, legal requirements, retention period and dependencies.

2. The CIA Triad and Accountability

2.1 Confidentiality

Confidentiality means protecting information from unauthorised access or disclosure. Controls include access permissions, encryption, segregation of duties, secure disposal and confidentiality agreements. Confidentiality is relevant to personal data, trade secrets, investigation records and security credentials.

Confidentiality is not the same as secrecy in every circumstance. An organisation may legitimately disclose information to an authorised regulator, auditor, customer or service provider. The key question is whether disclosure is authorised, necessary and consistent with applicable law and policy.

2.2 Integrity

Integrity means maintaining the accuracy, completeness, authenticity and reliability of information and systems. An integrity failure occurs when data is altered improperly, deleted without authorisation or generated by an untrusted process. Examples include changing a bank account number in a supplier record, modifying examination results or altering security logs.

Integrity controls include input validation, hashing, digital signatures, change management, access control, reconciliation, version control and tamper-evident logging. Integrity has both data and process dimensions: a correct result may still be untrustworthy if it was produced by an unauthorised or uncontrolled process.

2.3 Availability

Availability means that authorised users can access information and services when required, subject to agreed performance and recovery requirements. Availability controls include redundancy, backups, capacity planning, maintenance, disaster recovery and denial-of-service protection.

Availability is contextual. A public safety service may need to operate continuously, while an internal reporting system may tolerate several hours of downtime. Recovery objectives should therefore be based on business impact rather than on a generic claim that every system must be available at all times.

Two related planning measures are commonly used:

• Recovery time objective (RTO): the target maximum time within which a service should be restored after disruption.
• Recovery point objective (RPO): the target maximum period of data that the organisation can afford to lose, measured backward from the disruption.

For example, an RTO of four hours means the service should be restored within four hours. An RPO of one hour means that, after recovery, the organisation aims to lose no more than approximately one hour of data changes. These are planning objectives, not guarantees, unless supported by appropriate technology, contracts and testing.

2.4 Beyond the triad

The CIA triad is a foundation, not a complete security model. Other properties may be important:

• Authenticity: confidence that an entity or data source is genuine.
• Accountability: ability to associate actions with responsible entities.
• Non-repudiation: evidence that supports the origin or receipt of an action and makes denial more difficult.
• Privacy: appropriate control over the collection, use, disclosure and retention of information about individuals.

These properties overlap but are not interchangeable. For example, a log may support accountability, while a digital signature may support authenticity and evidence of integrity. Neither automatically proves that an action was lawful or ethically justified.

2.5 Accountability and responsibility

Responsibility concerns the duty to perform an assigned task. Accountability concerns being answerable for decisions, actions and outcomes. A system administrator may be responsible for applying patches, but a senior manager may remain accountable for ensuring that the organisation provides resources and oversight for patch management.

Effective accountability requires:

• clearly assigned roles;
• authority matching responsibility;
• reliable records and audit trails;
• measurable expectations;
• independent review where appropriate; and
• consequences and corrective action for failures.

Accountability should not be confused with blaming an individual after an incident. Mature governance examines decisions, incentives, controls and organisational conditions, while still addressing negligence or misconduct where evidence supports it.

3. Law, Regulation, Standards, Policies and Ethics

These terms are related but have different sources, authority and consequences.

3.1 Laws

A law is an enforceable rule recognised by a legal system. Cyber-related laws may address unauthorised access, fraud, interception, privacy, intellectual property, electronic transactions, evidence, critical infrastructure and breach notification. Laws can impose duties on organisations and may also provide investigators with powers subject to legal safeguards.

Legality is a minimum threshold. An action may be legal but still irresponsible, unfair or contrary to professional ethics. Conversely, an employee may violate an organisational policy without committing a criminal offence.

3.2 Regulations

Regulations provide detailed requirements within a legal framework. A data protection regulator, financial authority or communications regulator may issue rules concerning security safeguards, records, reporting or risk management. Regulations often apply to particular sectors or categories of data.

Organisations must determine which regulators and regulations apply based on factors such as location, industry, services, customers, data subjects and contractual relationships. Compliance should not be treated as a one-time checklist because regulatory expectations and organisational activities change.

3.3 Standards and frameworks

A standard expresses agreed requirements, specifications or practices. Some standards are technical; others concern management systems or control objectives. Frameworks organise concepts and practices without necessarily creating legal obligations. Examples include information security management standards and cybersecurity risk frameworks.

A standard becomes especially significant when it is:

• incorporated into a contract;
• required by a regulator or procurement rule;
• adopted as organisational policy; or
• used as evidence of reasonable security practice.

Certification to a standard does not guarantee that an organisation is secure. It normally demonstrates that a defined system was assessed against specified criteria at a particular time and scope.

3.4 Policies and procedures

A policy states management’s direction and mandatory expectations. A procedure explains how a task is performed. For example, an access-control policy may require least privilege and periodic review; a procedure may specify how managers request, approve and remove access.

A useful hierarchy is:

Law and regulation → external obligations and standards → organisational policy → procedures and technical controls.

The hierarchy is not absolute: a contract or standard may impose obligations that are stricter than legislation, and an organisation may choose controls exceeding the legal minimum.

3.5 Ethics

Ethics addresses what should be done, including situations where law and policy do not provide a complete answer. Ethical analysis in cybersecurity commonly considers autonomy, privacy, fairness, proportionality, transparency, public interest and avoidance of harm.

For example, an organisation may legally collect extensive employee activity data, yet ethical questions remain: Is the monitoring necessary? Are employees informed? Is the information protected? Is the monitoring proportionate to the risk? Could less intrusive controls achieve the same purpose?

Professional codes can help practitioners identify duties such as competence, honesty, confidentiality, respect for law and avoidance of conflicts of interest. Ethical reasoning is particularly important when new technologies, including artificial intelligence, create capabilities before detailed regulation exists.

4. Legal Systems and Jurisdiction

4.1 Legal systems

A legal system consists of institutions, rules and processes used to create, interpret and enforce law. Systems differ, but common sources may include constitutions, legislation, judicial decisions, administrative rules, contracts and customary principles.

A broad distinction is often made between:

• criminal law, which concerns offences against the state or public order and may result in prosecution and punishment; and
• civil law, which concerns disputes between individuals or organisations and may result in damages, injunctions or declarations.

The same cyber event may create both criminal and civil consequences. For example, unauthorised access may be prosecuted as an offence, while the affected organisation may pursue compensation for investigation and recovery costs.

4.2 Jurisdiction

Jurisdiction is the authority of a court, regulator or other institution to make decisions and enforce them. In cyberspace, several forms are important:

• Territorial jurisdiction: based on where conduct occurred or effects were experienced.
• Personal jurisdiction: based on a person’s or organisation’s connection to a legal authority.
• Subject-matter jurisdiction: based on the type of dispute or offence.
• Contractual jurisdiction: based on an agreed choice-of-law or forum clause, subject to legal limits.

A single cloud transaction may involve a customer in one country, a service provider in a second, data centres in a third and an attacker in a fourth. Questions may include which law governs, which authority can investigate, whether evidence can be obtained, and whether a judgment can be enforced abroad.

Jurisdictional analysis should not be reduced to the location of a server. Relevant connections may include the location of affected persons, business operations, conduct, consequences, contracts and regulatory obligations. Organisations should obtain qualified legal advice when cross-border issues arise.

4.3 Digital evidence

Digital evidence includes files, logs, messages, metadata, access records, device images and cloud-provider records that may establish facts. Its reliability depends on authenticity, integrity, relevance, lawful acquisition, secure preservation and clear documentation of handling.

A basic evidence process includes identifying potential evidence, preserving it against alteration, collecting it using appropriate methods, documenting custody and analysing it within legal and organisational authority. Security teams should avoid unnecessary alteration of original evidence and should coordinate with legal, privacy and investigative specialists.

5. Due Care and Due Diligence

Due care is the reasonable level of care expected in the circumstances. It concerns implementing appropriate safeguards and acting responsibly. Due diligence is the ongoing process of investigating, verifying and reviewing risks, controls and compliance.

For example, due care may involve deploying multi-factor authentication for privileged accounts. Due diligence may involve assessing whether the control is correctly configured, reviewing exceptions, testing effectiveness and reassessing it when threats or business conditions change.

The required level of care is contextual. Relevant factors may include:

• the sensitivity and criticality of assets;
• foreseeable threats and vulnerabilities;
• available safeguards and their cost;
• industry practice;
• legal and contractual duties;
• the organisation’s size and resources; and
• potential harm to individuals, customers and the public.

Due care does not require eliminating every possible risk. It requires a defensible, informed and proportionate approach. Ignorance is not normally a reliable defence when an organisation failed to identify risks that a reasonable professional process should have revealed.

6. Risk Management Foundations

6.1 Risk terminology

Important terms include:

• Threat: a potential cause of harm, such as phishing, malware, an insider or equipment failure.
• Vulnerability: a weakness that can be exploited or contribute to harm.
• Event: an occurrence that may affect assets or objectives.
• Incident: an event that has, or may have, an adverse effect and requires response.
• Impact: the consequence if a risk materialises.
• Likelihood: the chance or assessed possibility that an event will occur.
• Inherent risk: risk before considering controls.
• Residual risk: risk remaining after controls are applied.
• Risk owner: person accountable for ensuring that a risk is managed.
• Risk appetite: the broad amount and type of risk an organisation is willing to accept in pursuit of objectives.
• Risk tolerance: the acceptable variation or boundary for a particular objective or risk.
• Control: a measure that modifies risk, such as prevention, detection, correction or recovery.

6.2 Risk assessment and treatment

Risk assessment identifies assets, threats, vulnerabilities, consequences and likelihood. Risk analysis may be qualitative, using categories such as low, medium and high, or quantitative, using numerical estimates where data and assumptions are sufficiently reliable.

A simple qualitative model is:

Here, likelihood and impact are ordinal scores, such as 1 to 5. This multiplication is a prioritisation convention, not a universal law of probability. It assumes that the organisation has defined consistent scales and understands that a numerical score may hide uncertainty.

A simple quantitative expected-loss model is:

where ALE is annual loss expectancy, SLE is single loss expectancy in currency units, and ARO is annual rate of occurrence. This model assumes that the loss estimate and occurrence rate are meaningful and that repeated events can reasonably be represented by an average. It should not be treated as a precise prediction when evidence is weak.

For example, if one incident is estimated to cause a loss of $20,000 and is expected to occur 0.25 times per year, then:

The result supports comparison of treatment options; it does not justify spending exactly $5,000, because controls also affect legal exposure, safety, reputation and uncertainty.

Risk treatment options include:

• Avoid: discontinue the activity creating unacceptable risk.
• Reduce or mitigate: implement controls to lower likelihood or impact.
• Transfer or share: use insurance, contracts or outsourcing, while recognising that accountability may remain.
• Accept: consciously retain the risk within approved limits.

Risk acceptance should be documented by an authorised risk owner, with reasons, duration, compensating controls and review conditions.

7. Security Governance

Governance is the system by which an organisation is directed, overseen and held accountable. Security governance connects cybersecurity to organisational objectives rather than treating it as an isolated technical function.

Governance answers questions such as:

• Who sets security priorities?
• Who owns information assets and risks?
• What level of risk is acceptable?
• How are resources allocated?
• How does the board or governing body receive assurance?
• How are suppliers and outsourced services controlled?
• What happens when policy is breached?

Management is responsible for planning and operating controls; governance provides direction, oversight and accountability. A board need not configure a firewall, but it should understand major cyber risks, approve appropriate oversight and challenge unexplained deficiencies.

7.1 Governance principles

Effective governance commonly includes:

• Strategic alignment: security supports mission and business objectives.
• Risk-based decision-making: resources reflect potential harm and uncertainty.
• Clear accountability: ownership is assigned at appropriate levels.
• Transparency: significant decisions, exceptions and incidents are reported honestly.
• Independent assurance: audits, assessments and testing provide credible evidence.
• Continuous improvement: lessons from incidents, exercises and changes update controls.
• Stakeholder protection: decisions consider customers, employees, suppliers and the public.

7.2 The three lines model

A commonly used organisational arrangement distinguishes three roles:

1. First line: operational management owns and manages risks in daily activities.
2. Second line: risk, compliance and security functions provide expertise, monitoring and challenge.
3. Third line: internal audit provides independent assurance to governing bodies.

The model clarifies roles but does not eliminate the need for cooperation. Internal audit should not become the owner of controls it later has to assess, and security specialists should not assume that business managers are relieved of their risk responsibilities.

7.3 Governance artefacts and metrics

Useful governance artefacts include an information-security policy, asset register, risk register, data classification scheme, access standard, incident-response plan, supplier requirements, exception register and business-continuity plan.

Metrics should support decisions rather than create an illusion of control. Examples include the percentage of critical assets with identified owners, the age of high-risk vulnerabilities, privileged-access review completion, time to contain incidents and backup restoration test results. A high number of detected incidents may indicate improved visibility rather than worsening security; metrics require context and interpretation.

8. Compliance and Control Mapping

Compliance is the state or process of meeting applicable legal, regulatory, contractual, policy or standard-based requirements. A compliance programme identifies obligations, maps them to controls, gathers evidence, tests effectiveness and remediates gaps.

Control mapping can reduce duplication. One access-control measure may support privacy obligations, contractual requirements and a security standard. However, a single control may not fully satisfy every obligation because requirements differ in scope, definitions, evidence and enforcement.

A mature compliance approach distinguishes:

• Design effectiveness: whether a control is suitably designed to address a requirement.
• Operating effectiveness: whether the control operated as designed over the relevant period.
• Outcome: whether the control actually reduced risk to an acceptable level.

Compliance evidence may include approvals, access reviews, configuration records, training records, test results, incident logs and supplier attestations. Evidence must be accurate, appropriately protected and retained according to legal and organisational requirements.

9. Applied Case: A Retailer’s Cloud Data Incident

The following is a fictional illustrative case.

Background

Northbridge Retail operates an online store and uses a cloud database containing customer names, addresses, order histories and contact details. A third-party development team has remote access for maintenance. The organisation has a general security policy but no formal asset register or documented risk owners.

Problem

A developer’s password is reused from another service and is exposed in a phishing attack. The attacker accesses the cloud environment and downloads customer records. The retailer discovers unusual activity after a monitoring alert three days later. It is initially uncertain which records were accessed and whether the developer’s account had more privileges than necessary.

Analysis

The incident affects all three CIA properties. Confidentiality is affected by unauthorised disclosure. Integrity must be investigated because the attacker may have altered records. Availability may be affected if credentials and systems are disabled without a recovery plan.

Legal and governance questions include:

• Which privacy and breach-notification obligations apply?
• Which contracts govern the cloud provider and developer?
• Was access appropriately authorised and reviewed?
• Were logs preserved for investigation?
• Who is the incident decision-maker?
• What must be communicated to customers, regulators and insurers?

The root causes are not limited to the developer’s mistake. They include weak authentication, excessive third-party privileges, inadequate monitoring, incomplete asset ownership and insufficient due diligence.

Approach and solution

Northbridge should first contain the incident lawfully and preserve evidence. It should disable or rotate compromised credentials, enforce multi-factor authentication, restrict access using least privilege, preserve cloud and endpoint logs, and engage its incident-response, legal, privacy and communications functions.

Next, it should determine the affected data, time period, individuals and likely consequences. The organisation should follow applicable notification requirements and contractual procedures, avoiding speculation while communicating material facts clearly.

For longer-term improvement, Northbridge should establish an asset and data inventory, appoint risk owners, classify customer information, review suppliers, implement privileged-access management, test backups and conduct exercises. The board or governing body should receive a report describing risk, decisions, costs and remediation status.

Outcome and learning points

The retailer restores confidence more effectively when it demonstrates both immediate response and structural improvement. The central lesson is that cyber risk is socio-technical and governed through people, processes, technology and legal accountability. A policy alone is insufficient; controls must be implemented, tested and overseen.

10. Contemporary Developments and Challenges

Cloud computing distributes responsibility between customers and providers. Organisations must understand the shared-responsibility model, service terms, data locations, subcontractors, logging capabilities and exit arrangements. Outsourcing a function does not automatically outsource legal accountability.

Artificial intelligence creates additional governance questions. Organisations should consider data provenance, confidentiality, model integrity, bias, explainability, human oversight, supplier terms and the possibility that generated output is inaccurate. AI systems may process sensitive information or make decisions affecting individuals, so privacy, fairness and accountability must be assessed before deployment.

The Internet of Things and operational technology increase the consequences of compromise because devices may control physical processes or safety-related functions. Legacy systems, long service lives and limited patching options make compensating controls and segmentation important.

Other persistent challenges include ransomware, supply-chain compromise, regulatory fragmentation, shortage of skilled personnel, shadow technology and alert overload. No framework removes uncertainty. Governance must therefore support prioritisation, resilience and informed decision-making rather than promise perfect security.

Best-Practice Foundations

A diploma-level practitioner should encourage an organisation to:

1. identify and classify important information assets;
2. assign owners and document accountability;
3. maintain a risk register connected to business objectives;
4. apply least privilege and strong authentication;
5. protect confidentiality, integrity and availability together;
6. maintain tested backups and incident-response procedures;
7. assess suppliers and contractual responsibilities;
8. preserve evidence and respect legal authority during investigations;
9. map obligations to controls and retain reliable evidence; and
10. review risks, policies and controls as technology and law change.

These practices are foundations rather than a complete security programme. Their effectiveness depends on implementation, testing, resources and leadership.

Chapter Summary

Cyberspace is a socio-technical environment in which digital systems, people, organisations and legal institutions interact. Information assets include data, systems, services, credentials and processes whose value depends on sensitivity, criticality and obligations.

The CIA triad provides the basic security objectives of confidentiality, integrity and availability. Authenticity, privacy, accountability and non-repudiation extend the model. Accountability requires clear ownership, authority, records and oversight; it is broader than assigning blame.

Laws and regulations are enforceable requirements, standards provide agreed practices, policies direct organisational behaviour, and ethics guides responsible action beyond minimum legal compliance. Cyber incidents may involve criminal, civil, regulatory, contractual and ethical consequences simultaneously. Jurisdiction is complex because conduct, systems, victims and providers may cross borders.

Due care means acting reasonably in the circumstances, while due diligence involves continuing investigation, verification and review. Risk management identifies threats, vulnerabilities, likelihood and impact; treats risk through avoidance, reduction, transfer or acceptance; and records residual risk. Governance directs and oversees security by establishing strategy, accountability, risk appetite, assurance and improvement.

A professional cybersecurity practitioner must connect technical controls with legal duties, business objectives, human consequences and evidence-based oversight. Security is therefore not only a technology function but also a governance and professional responsibility.

Key Terms

Accountability: Being answerable for decisions, actions and outcomes.

Asset: Information or a resource that has value and requires protection.

Availability: Accessibility of information or services to authorised users when required.

Confidentiality: Protection against unauthorised access or disclosure.

Control: A measure that modifies risk through prevention, detection, correction or recovery.

Due care: Reasonable care expected under the circumstances.

Due diligence: Ongoing investigation, verification and review of risks and controls.

Governance: Direction, oversight and accountability through which an organisation is managed.

Integrity: Accuracy, completeness, authenticity and reliability of information and systems.

Jurisdiction: Legal authority of a court, regulator or institution.

Likelihood: Assessed possibility that an event will occur.

Residual risk: Risk remaining after controls are applied.

Risk appetite: Broad amount and type of risk an organisation is willing to accept.

Risk owner: Person accountable for managing a specified risk.

Standard: Agreed specification or good-practice requirement, usually voluntary unless adopted or required.

Threat: Potential cause of harm.

Vulnerability: Weakness that may be exploited or contribute to harm.

Compliance: Meeting applicable legal, regulatory, contractual, policy or standard-based requirements.

Review Questions

5 Short Answer Questions

1. Define cyberspace and explain why it is described as socio-technical.
2. What are confidentiality, integrity and availability?
3. Distinguish due care from due diligence.
4. What is jurisdiction, and why is it complex in cloud environments?
5. Define residual risk and risk appetite.

5 Long Answer Questions

1. Explain the differences among laws, regulations, standards, policies and ethics, using a cybersecurity example for each.
2. Discuss accountability and explain how it differs from responsibility in security governance.
3. Describe the main stages of risk assessment and risk treatment.
4. Explain how criminal, civil, regulatory and contractual consequences may arise from one cyber incident.
5. Discuss the role of governance bodies, management, security functions and internal audit in cybersecurity oversight.

3 Analytical / Application Questions

1. A hospital’s patient database is available to staff but several records have been altered without authorisation. Analyse the CIA properties affected and recommend controls.
2. A company accepts a high residual risk because a legacy system cannot be patched. Identify the governance and due-diligence actions required before and after acceptance.
3. A cloud provider stores customer data in several countries and suffers a breach. Develop a structured list of legal, contractual, evidence, notification and governance questions the customer should investigate.

Multiple Choice Questions with Answers

Question 1

Which statement best describes cyberspace?

A. Only the public internet and websites

B. An interconnected socio-technical environment involving technology, data, people and activities

C. A physical facility used to store servers

D. A legal system governing computer crime

Correct Answer: B. An interconnected socio-technical environment involving technology, data, people and activities

Question 2

Which CIA property is primarily affected when an unauthorised person reads customer records?

A. Confidentiality

B. Integrity

C. Availability

D. Recoverability

Correct Answer: A. Confidentiality

Question 3

What is the main distinction between due care and due diligence?

A. Due care concerns criminal law, while due diligence concerns civil law

B. Due care is reasonable protection, while due diligence is continuing investigation and review

C. Due care applies only to suppliers, while due diligence applies only to employees

D. Due care is voluntary, while due diligence is always a technical standard

Correct Answer: B. Due care is reasonable protection, while due diligence is continuing investigation and review

Question 4

Which instrument normally directs internal organisational behaviour and may lead to disciplinary consequences when violated?

A. Policy

B. Constitution

C. International treaty

D. Court judgment

Correct Answer: A. Policy

Question 5

A risk has an estimated single loss expectancy of $20,000 and an annual rate of occurrence of 0.25. Using ALE = SLE × ARO, what is the annual loss expectancy?

A. $5,000

B. $20,250

C. $80,000

D. $200,000

Correct Answer: A. $5,000

Question 6

Which option is a risk treatment strategy?

A. Authenticate

B. Transfer

C. Classify

D. Audit

Correct Answer: B. Transfer

Question 7

What does jurisdiction refer to in cyber law?

A. The strength of an encryption algorithm

B. The authority of a legal institution to make decisions and enforce them

C. The number of devices on a network

D. The classification of information assets

Correct Answer: B. The authority of a legal institution to make decisions and enforce them

Question 8

Which governance role is most closely associated with independent assurance?

A. First-line operational management

B. Third-line internal audit

C. External attacker

D. System end user

Correct Answer: B. Third-line internal audit

Question 9

Which statement about outsourcing cybersecurity responsibilities is most accurate?

A. Outsourcing automatically removes the customer’s legal accountability

B. Outsourcing eliminates the need for supplier contracts

C. Outsourcing may delegate operations, but accountability and oversight may remain with the organisation

D. Outsourcing makes risk assessment unnecessary

Correct Answer: C. Outsourcing may delegate operations, but accountability and oversight may remain with the organisation

Question 10

What is the primary purpose of an asset register?

A. To identify and document important assets, their owners and relevant characteristics

B. To replace all incident-response procedures

C. To guarantee that no cyberattack can occur

D. To determine criminal penalties automatically

Correct Answer: A. To identify and document important assets, their owners and relevant characteristics