In this lesson,
we will learn about cross-jurisdictional compliance.
Cross-jurisdictional compliance requirements
establish standards that ensure an organization's practices
are compliant with all applicable local, national,
and international laws.
Compliance may involve items such as due diligence,
due care, contractual obligations, and export controls.
Let's explore each of these items in more detail.
First, let's talk about due diligence and due care.
Think of due diligence and due care,
like buying and maintaining a car.
Both are necessary,
but they happen at different stages
of the car buying and car ownership process.
To understand due diligence,
let's imagine we're buying that car.
Before we make the purchase,
we do our homework by researching different models,
reading reviews, comparing prices,
and checking the car's history.
This is all about being cautious
and thorough before making a big purchase decision.
In the information security world, due diligence is similar.
It involves all the preparation
and investigation a company does before taking an action,
such as adopting a new software solution,
or launching a new service.
Due diligence helps identify potential risks,
enabling the organization to determine
and implement necessary security measures ahead of time.
Now, once we buy that car, we need to exercise due care.
As a car owner,
it's our responsibility to keep the car in a good condition.
This means taking it for regular oil changes,
rotating the tires, and fixing any issues that arise,
basically doing maintenance to prevent breakdowns.
In the same way, due care in information security means
taking ongoing actions to protect against risks.
For example, after identifying potential threats
through due diligence,
a company then has to maintain and monitor
their systems regularly,
making sure their security measures are actively working
to protect data.
This is due care.
Next, let's talk about contractual obligations.
Contractual obligations are specific requirements
that are included in contracts.
These can be quite tricky,
especially if a company works in a number
of different jurisdictions.
Legal and regulatory requirements can vary widely
from one location to another.
For example, imagine our company operates in the U.S.
but handles data for clients in Europe.
In this case,
we need to comply not only with U.S. regulations,
but also with European ones,
like the General Data Protection Regulation, or GDPR.
Our contract might include clauses
that specifically address this,
making it clear who's responsible
for ensuring that local laws are followed in each region.
This means our company has to keep track
of different privacy laws, data protection standards,
and security requirements across multiple countries.
Tracking different privacy laws can be challenging,
but it's crucial for avoiding legal penalties
and maintaining trust with clients.
Now, let's discuss legal hold and e-discovery.
Legal holds require companies to prevent the deleting,
or altering of information because that information
might be used as evidence in court.
Importantly, information that is kept as part
of a legal hold may or may not be used as evidence.
Its use isn't guaranteed.
The case may not even end up in court,
or lawyers may decide not to use the evidence.
But the goal of legal hold is
to preserve everything relevant just in case
it's needed later in court.
Now, let's talk about e-discovery.
E-discovery is the process of searching
through all preserved data, such as emails, documents,
and saved files, to find out what's important
for a court case.
E-discovery is typically conducted
by a combination of legal teams,
meaning lawyers and paralegals, IT professionals,
and sometimes specialized third-party e-discovery vendors.
Finally, let's consider export controls.
Export controls regulate the international transfer
of dual-use technologies.
Like contractual obligations,
export controls can get complicated
where cross-jurisdictional compliance is required.
This is especially true in the tech world,
where cybersecurity tools like Check Point's Firewall
and VPN software are involved.
Check Point's Firewall and VPN software
use strong encryption to secure networks
and communication.
Strong encryption is considered dual-use technology,
meaning it has both civilian and military applications.
Because of this, Check Point's Firewall
and VPN software fall under the Wassenaar Arrangement.
The Wassenaar Arrangement is an international agreement
that controls the export of dual-use technologies.
So, if a company wants
to export Checkpoint's security software to another country,
they have to ensure compliance with local
and international export laws.
This often means applying for an export license
before shipping software to certain countries,
especially those with restrictions or sanctions upon them.
Failure to follow these controls can result
in hefty fines and penalties.
So, it's very important for companies
to navigate these regulations carefully
to avoid legal trouble.
So, remember, cross-jurisdictional compliance ensures
that organizations adhere to local, national,
and international laws.
Key areas of focus include due diligence, due care,
contractual obligations, and export controls.
Due diligence involves thorough preparation
and risk identification before taking action,
while due care is about maintaining
ongoing security measures after action has been taken.
Contractual obligations across regions require companies
to comply with varying laws,
such as data privacy regulations.
Finally, export controls regulate the international transfer
of dual-use technologies,
ensuring compliance with agreements like
the Wassenaar Arrangement to avoid legal issues.