Helpful first: Outcomes before controls: using NIST CSF, CIS, ISO 27001, and ATT&CK together
Key points
- Distinguish criminal law, civil tort law, and administrative or regulatory law by burden of proof and remedy
- Apply the four ISC2 Code of Ethics canons in strict priority order when duties conflict
- Sequence personnel security controls across candidate screening, job rotation, mandatory vacations, and termination
Three branches of law and prudent due care
At Meridian Space & Robotics (chronos.orbital), VP of Legal & Compliance Sloane Sterling separates legal exposure into three distinct tracks before advising engineering leadership. Criminal law addresses offenses against society and statutes such as the Computer Fraud and Abuse Act (CFAA). Prosecutors must prove guilt beyond a reasonable doubt, and penalties include incarceration and statutory fines.
Civil law (including tort and contract law) resolves disputes between private parties. In a civil negligence suit after a data breach, the plaintiff only needs to show a preponderance of the evidence (more likely than not) that the organization failed to exercise reasonable care. Administrative or regulatory law flows from government agencies enforcing standards such as GDPR, HIPAA, FISMA, or FAA export rules.
Courts and regulators evaluate negligence through two paired concepts: due diligence and due care. Due diligence is the research and investigation phase ("knowing what is right" by assessing risks and auditing suppliers). Due care is the active implementation phase ("doing what is right" by patching systems, enforcing MFA, and training staff) that a prudent person would take under similar circumstances.
| Concept | Scope and standard | Security practitioner action |
|---|---|---|
| Criminal vs Civil vs Regulatory | Criminal requires proof beyond a reasonable doubt. Civil requires preponderance of the evidence and awards damages. Regulatory enforces agency compliance. | Preserve forensic chain of custody for law enforcement and maintain due-care records to defend against civil negligence claims. |
| Intellectual Property (Patent, Copyright, Trade Secret, Trademark) | Patents protect novel inventions publicly disclosed. Copyrights protect expression of ideas (code/docs). Trade secrets protect confidential formulas without registration if reasonable secrecy controls exist. | Enforce strict access controls, NDAs, and DLP on trade secrets (such as orbital propulsion algorithms), because public leak destroys trade-secret status. |
| ISC2 Code of Ethics (4 Canons) | Canon I (Society) > Canon II (Honor/Law) > Canon III (Employer/Principal) > Canon IV (Profession). | If an employer orders you to conceal a public-safety hazard or break the law, Canon I and Canon II override Canon III. |
The ISC2 Code of Ethics and intellectual property
When an engineering deadline collides with a safety or legal obligation, the ISC2 Code of Ethics provides a deterministic tie-breaker. The four canons are ordered by priority: first, protect society, the common good, necessary public trust and confidence, and the infrastructure; second, act honorably, honestly, justly, responsibly, and legally; third, provide diligent and competent service to principals; fourth, advance and protect the profession.
Because Canon I and Canon II outrank Canon III, a practitioner can never justify an illegal act or a threat to human life by claiming "my employer ordered me to do it." Equally, claiming competence in a domain you have not mastered or running an unauthorized penetration test without written permission violates Canon II and Canon III.
Intellectual property protection also depends on choosing the right legal mechanism. Meridian protects its orbital trajectory source code under copyright, its brand insignia under trademark, its thruster nozzle hardware under a 20-year patent, and its proprietary fuel telemetry calibration under trade secret. Unlike a patent, a trade secret requires no government filing and never expires, provided Meridian can prove it enforced continuous confidentiality controls and non-disclosure agreements.
Personnel security from screening to offboarding
Technical controls can be bypassed by a trusted insider if personnel security is neglected. Before hiring, organizations conduct background checks, reference verification, and credential validation proportional to the sensitivity of the role and local employment law. Upon onboarding, employees sign the Acceptable Use Policy (AUP) and Non-Disclosure Agreement (NDA) before receiving least-privilege credentials.
During active employment, two administrative controls detect and deter fraud or collusion: job rotation and mandatory vacations. Rotating engineers across operational duties ensures no single individual monopolizes a critical workflow, while a mandatory one-to-two-week block vacation with temporary privilege suspension allows a replacement operator to audit and observe the environment for hidden backdoors or unauthorized manual workarounds.
At termination, sequence matters. In a voluntary resignation, HR and security disable access on the final day, recover hardware assets, and remind the departing employee of surviving NDA obligations. In an involuntary or high-risk termination, Kael Cho revokes active sessions, directory accounts, SSH keys, and physical badges immediately before or at the exact moment HR notifies the individual.
CHECK YOUR JUDGMENT
A senior propulsion engineer at Meridian Space & Robotics (chronos.orbital) is scheduled for involuntary termination at 14:00 UTC after an internal investigation reveals unauthorized copying of trade-secret telemetry models. What action should the security team take FIRST to protect the organization?
NEXT FIELD LESSON