Incident › Module 8 › Lesson 2
Legal Compliance
Legal compliance literacy — regulatory notification triggers, counsel engagement, record retention — category rows on YOUR `$IR_LAB` tabletop.
Visual · t34_legal_compliance
Legal compliance = named regulatory rows. $IR_LAB. Original Cyberlium.
Opening
Legal gates shape IR comms and timing — name regulatory and counsel checkpoints on YOUR lab tabletop, not unauthorized legal advice or prod filings.
Legal compliance literacy names: engage legal counsel early category, regulatory notification trigger factors category (breach definition literacy stub — jurisdiction varies), record retention and litigation hold category, law enforcement coordination gate category, and contract/third-party obligation review category. Analyst documents legal checkpoint list on `$IR_LAB` tabletop stub — lists factors legal would weigh, escalation stub to counsel — without filing real regulatory notices without authorization, without impersonating legal counsel, without claiming jurisdiction-specific advice as universal fact. Cyberlium teaches awareness vocabulary — counsel owns legal decisions. Refused: unauthorized regulatory filing, legal impersonation, prod counsel bypass. Lab row: legal checkpoint list (five factors, counsel escalation stub, NEVER unauthorized filing line).
1. Named legal checkpoints
Counsel engagement, notification triggers, retention/hold, law enforcement gate, contract review — five literacy anchors.
Jurisdiction varies — document 'consult counsel' stub, not universal legal claims.
Command guide
Try these commands — Named legal checkpoints
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final ISO/IEC 27035 — https://www.iso.org/standard/78973.html CISA — https://www.cisa.gov/stopransomware
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/comms/legal-compliance-notes.txt" <<'EOF'
Legal & compliance — YOUR org literacy notes:
Breach notification: GDPR 72h, state US laws, sector regs (HIPAA, PCI) — consult legal
Preserve privilege: involve legal early; document decision rationale
Regulatory reporting: determine if reportable incident per severity matrix
Law enforcement: FBI IC3, sector ISAC — coordinate via legal
No admission of fault in external comms without legal review
Lab: checklist items for LAB-IR-RANSOM-001 tabletop — fictional jurisdiction
EOFCommand — copy this
grep -E 'Breach notification|legal|IC3|tabletop' "$IR_LAB/comms/legal-compliance-notes.txt" curl -sS https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); ISO/IEC 27035 (https://www.iso.org/standard/78973.html); CISA (https://www.cisa.gov/stopransomware). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Analyst boundary
Analyst documents facts and escalates — legal interprets regulatory obligations.
Link Module 8-1 comms approval gate to counsel review row.
3. Refused
No unauthorized regulatory filing; no legal impersonation; no universal breach advice.
Legal literacy supports escalation — not unauthorized legal action.
4. What you ship: legal checkpoint list
Five legal factors + counsel escalation stub + NEVER unauthorized filing line.
5. What you record before the next lesson
Legal checkpoint list path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
File real regulatory breach notice without org authorization as 'compliance lab.'
Right
Legal checkpoint list from `$IR_LAB` tabletop stub. Next: External Notify.
Mission: legal checkpoint list
1) Name five legal compliance rows. 2) Counsel escalation stub. 3) Link comms approval gate. 4) Write NEVER unauthorized regulatory filing line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Litigation hold — literacy trigger stub?”
Knowledge Check
APPLY: Legal compliance literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Analysts should claim universal breach law advice.
True or False
Knowledge Check
APPLY: Legal checkpoints include:
Multiple choice