Law, Compliance, Governance, Policy, and Ethics

Key Details

The “Law, Compliance, Governance, Policy, and Ethics” module focuses on equipping students with an in-depth understanding of the legal, ethical, and governance frameworks that shape cybersecurity practices. It provides comprehensive insights into data protection laws, governance structures, and the intersection of legal and ethical standards in organizational cybersecurity strategies. Students will engage with real-world applications of laws such as the GDPR, NIS2, and the Cyber Resilience Act learning how to implement compliance measures and ethical practices in diverse cybersecurity environments. Through case studies, discussions, and practical exercises, students will develop the skills needed to craft and assess policies, promote ethical cybersecurity practices, and lead with integrity in professional settings.

Time commitment

• (Estimated) Total workload: 125 hrs
• Contact hours: 20 hours e-learning, 10 hours asynch.
• Private study including examination preparation, specified in hours: 95 hours (75 self-reading / 20 hours exams preparation)

Assessment

• Part 1: Final Written Exam (Proctored Multiple-Choice Questionnaire, 60%) – 60 minutes. This exam will cover key concepts, legal frameworks, and technical aspects of cybersecurity.
• Part 2: Case Study Analysis or Presentation (40%) – Students may alternatively choose to select a relevant case study related to workplace surveillance, cybersecurity strategy, or data protection laws. They will submit a detailed written analysis or deliver a presentation, demonstrating their ability to apply theoretical knowledge to practical scenarios.

Subjects covered

Week 1: Legal Foundations of Cybersecurity

An introduction to key legal instruments, foundational concepts, and essential terminology in cybersecurity law.

Week 2: Regulatory and Legal Aspects of Cybersecurity Strategy and Operations (I)

An overview of relevant laws, acts, and regulations at the EU level, including NIS2, DORA, and the Cyber Resilience Act.

Week 3: Regulatory and Legal Aspects of Cybersecurity Strategy and Operations (II)

Examination of the European regulatory landscape for the Digital Decade, with a focus on cybersecurity-related laws such as the AI Act, Data Act, DSA, and DMA.

Week 4: Data Protection and Privacy

In-depth analysis of GDPR principles, key concepts, and the roles and responsibilities of various stakeholders.

Week 5: Cross-Border Data Protection

Exploration of the Law Enforcement Directive, ePrivacy Directive, and regulations governing cookies, as well as issues surrounding international data flows.

Week 6: Accountability and Compliance Management

Discussion of accountability mechanisms and compliance management strategies within organizations, with a focus on specific sectors.

Week 7: Legal Frameworks and Compliance

A detailed study of how legislation underpins cybersecurity and data protection, emphasizing EU laws and corporate compliance mechanisms.

Week 8: Standards and Certifications

Analysis of prominent EU cybersecurity standards and certifications, their enforceability, and the consequences of non-compliance.

Week 9: Governance in Cybersecurity

Examination of the integration of cybersecurity within broader IT governance frameworks and the role of policies in shaping organizational strategies.

Week 10: Ethical Considerations and Policy-Making

Exploration of the ethical dimensions of cybersecurity decisions and policy-making, with attention to the impact of emerging technologies like AI.

Learning objectives

Upon successful completion of this module, students will be able to:

Analyze Legal and Ethical Frameworks: Analyze and critically evaluate legal frameworks and ethical standards in cybersecurity, including the overlap and differences between cybersecurity, data protection, and privacy.

Interpret and Apply Cybersecurity Laws and Regulations: Interpret and apply legal requirements to protect information assets, ensuring compliance with international regulations and internal governance tools such as policies or standards.

Craft and Evaluate Policies: Craft and assess policies that address ethical, legal, and practical aspects of cybersecurity operations while promoting organizational integrity.

Integrate Ethical Cybersecurity Practices: Integrate and promote ethical considerations in decision-making and conduct across all levels of the organization, enhancing organizational integrity through privacy, confidentiality, and accountability.