| 🏠 Back to Exam Syllabus | 📺 RooCloud on YouTube | 🌐 RooCloud Practice Exams |
CISSP 4.2 - Laws (Part 1 of 4)
This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series opens a four-part tour of the laws that shape information security work, part of Domain 1. This first part focuses on the statutes that target computer crime and protect federal systems — why they exist, what they cover, and how they define who acts when an incident becomes a prosecutable offense.
What this episode covers
- Why computer-specific statutes exist — old rules did not fit new crimes, so lawmakers defined computer crime directly.
- Computer Fraud and Abuse Act — the cornerstone federal statute, written narrowly to cover crimes crossing state lines.
- Protected systems — government and financial computers, later any machine involved in interstate commerce, plus malicious code.
- National infrastructure protection — extends the shield to railroads, pipelines, grids, telecom lines, and international commerce.
- Federal information security management — mandatory security programs for every agency and its contractors.
- The modern cybersecurity wave — centralized duties, coordinated voluntary standards, and a national threat-sharing center.
Watch the full episode above for the worked examples and detailed explanations of each concept.
Frequently Asked Questions
Why did lawmakers write computer-specific statutes at all?
Because the old rules did not fit the new crimes. Early prosecutors tried to squeeze computer offenses into traditional criminal law, and many cases collapsed because judges felt stretching an old statute to cover a modem was a reach too far. Legislators responded by defining computer crime directly and attaching clear penalties — like writing traffic laws once cars appeared.
What does the Computer Fraud and Abuse Act cover?
It is the cornerstone statute for federal computer crime, written narrowly on purpose to cover only crimes that cross state lines, keeping it on solid constitutional ground. It protects computers used by the government, by financial institutions, and any machine whose compromise disrupts those operations. Over time it grew to cover any computer involved in interstate commerce, and to criminalize malicious code.
How did the national infrastructure protection act widen that reach?
It stretched the fence beyond computers themselves, extending protection to railroads, pipelines, power grids, and telecommunications lines. It also reached beyond domestic borders to cover systems used in international commerce, and it treated any reckless act that damages critical infrastructure as a felony.
What does the federal information security management act require?
It forces every federal agency to run a real information security program covering the agency’s own operations and the work of its contractors. Official implementation guidelines lay out the ingredients of an effective program: regular risk assessments, policies grounded in that risk, security awareness training, periodic testing of controls, incident response procedures, and continuity planning.
What did the wave of modern cybersecurity laws add?
It modernized and divided the responsibilities. One law centralized most federal cybersecurity duties under the homeland security department, while defense and intelligence kept their own lanes. Another tasked the standards agency with coordinating voluntary cybersecurity standards nationwide, and a third created a national center to share threats and warnings between government and private organizations. The standards agency also publishes a widely used series of security guidance, from a controls catalog to a voluntary risk-based framework.
📚 Master the ISC2 CISSP Exam!
Ready to test your knowledge? Access chapter-specific Multiple Choice Questions (MCQs) and full-length practice exams for the ISC2 CISSP certification at RooCloud.com. Solve the chapter-wise questions to reinforce this lesson before moving to the next episode.
Reference: This article is based on concepts discussed in CISSP 4.2 - Laws (Part 1 of 4).