Chartered IT Professional (CITP) Law, Regulation and Governance Syllabus

What are pseudonymisation and anonymisation, and how do they differ under data protection law?

Pseudonymisation replaces identifying fields with artificial identifiers so data can no longer be attributed to a subject without additional information held separately — it remains personal data. Anonymisation irreversibly prevents identification, so the data falls outside UK GDPR scope.

What three offences does the Computer Misuse Act 1990 create?

Section 1: unauthorised access to computer material; Section 2: unauthorised access with intent to commit or facilitate further offences; Section 3: unauthorised acts with intent to impair, or with recklessness as to impairing, the operation of a computer (e.g. malware, DoS).

What additional offence was added to the Computer Misuse Act by the Police and Justice Act 2006?

Section 3A: making, supplying or obtaining articles (e.g. hacking tools or malware) for use in committing computer misuse offences under sections 1 or 3.

What is the maximum sentence for the Section 3ZA Computer Misuse Act offence of unauthorised acts causing serious damage?

Up to life imprisonment where the unauthorised act causes, or creates significant risk of, serious damage to human welfare or national security; up to 14 years for serious damage to the economy or environment. (Section added by the Serious Crime Act 2015.)

Define 'phishing' and 'social engineering' in a cybercrime context.

Social engineering is the manipulation of people into divulging confidential information or performing actions that compromise security. Phishing is a specific form using fraudulent communications (often email) that appear legitimate to trick victims into revealing credentials or installing malware.

What is the difference between a virus, a worm, and a Trojan?

A virus attaches to a host file and requires user action to spread. A worm is self-replicating and spreads across networks without user intervention. A Trojan disguises itself as legitimate software to trick users into running it, then delivers a malicious payload but does not self-replicate.

What is ransomware and what is the recommended response stance?

Ransomware is malware that encrypts a victim's data (or locks systems) and demands payment for the decryption key. Authorities (NCSC/ICO) advise against paying the ransom, as payment does not guarantee recovery and encourages further attacks; instead rely on tested backups and incident response plans.

What are the four types of intellectual property recognised in UK law?

Copyright, patents, trade marks, and design rights (registered and unregistered). Trade secrets/confidential information are also protected, by the law of confidence rather than as a registered IP right.

How long does copyright last for literary works (including software) in the UK?

For literary, dramatic, musical and artistic works (software is protected as a literary work), copyright lasts for the life of the author plus 70 years from the end of the year of their death.

Does software require registration to be protected by copyright in the UK?

No. Under the Copyright, Designs and Patents Act 1988, copyright arises automatically when an original work (including source code) is created and fixed; there is no registration system for copyright in the UK.

What conditions must an invention satisfy to be patentable in the UK?

It must be new (novel), involve an inventive step (non-obvious), be capable of industrial application, and not fall within excluded categories. Notably, computer programs 'as such' and mathematical methods are excluded, though a program producing a technical effect may be patentable.

How long does a UK patent last and what is required to maintain it?

A UK patent lasts up to 20 years from the filing date, subject to payment of annual renewal fees (typically from the 5th year onward).

What is the difference between a registered and an unregistered trade mark?

A registered trade mark (R symbol) is granted by the IPO, lasts 10 years and is indefinitely renewable, giving statutory exclusive rights. An unregistered mark (TM symbol) is protected only through the common law tort of 'passing off', which requires proving goodwill, misrepresentation and damage.

In an employment context, who typically owns the IP in software created by an employee?

Under the CDPA 1988, where a work is made by an employee in the course of their employment, the employer is the first owner of any copyright (and similarly for patents under the Patents Act 1977), unless a contract states otherwise. Contractors/freelancers usually retain IP unless assigned in writing.

What essential elements must be present to form a legally binding contract under English law?

Offer, acceptance, consideration, intention to create legal relations, and capacity (and the contract must be for a lawful purpose with certainty of terms).

What is the difference between a contractual warranty and a condition?

A condition is a fundamental term going to the root of the contract; its breach entitles the innocent party to terminate and claim damages. A warranty is a minor term; its breach entitles the innocent party only to damages, not termination.

What is a limitation of liability clause, and what types of liability cannot lawfully be excluded?

A limitation clause caps or restricts the damages one party can recover. Under the Unfair Contract Terms Act 1977, liability for death or personal injury caused by negligence cannot be excluded, and liability for fraud cannot be excluded; other exclusions must satisfy a test of reasonableness.

Distinguish between liquidated damages and a penalty clause in English contract law.

Liquidated damages are a genuine pre-estimate of loss agreed in advance and are enforceable. A penalty clause imposes a sum out of all proportion to any legitimate interest and is intended to punish; it is unenforceable. The modern test is whether the clause is a proportionate protection of a legitimate interest.

What is the difference between contractual liability and tortious liability (negligence)?

Contractual liability arises from breach of an agreed term between parties to a contract. Tortious liability (e.g. negligence) arises independently of any contract, from a breach of a duty of care owed in law, where the breach causes foreseeable harm to another.

What three elements must a claimant prove to establish negligence?

1) The defendant owed the claimant a duty of care; 2) the defendant breached that duty (fell below the reasonable standard); 3) the breach caused reasonably foreseeable damage (causation and remoteness).

What is COBIT and what is its purpose?

COBIT (Control Objectives for Information and Related Technologies), developed by ISACA, is an IT governance and management framework. It helps organisations align IT with business goals, manage IT-related risk, ensure regulatory compliance, and create value through governance and management objectives.

What is the difference between IT governance and IT management?

IT governance is the responsibility of the board/executives — it sets direction, evaluates options, and monitors performance to ensure IT delivers value and manages risk (the 'what' and 'why'). IT management plans, builds, runs and monitors activities to achieve those directions (the 'how').

What does ITIL provide and what is its focus?

ITIL (Information Technology Infrastructure Library) is a framework of best practices for IT Service Management (ITSM). It focuses on aligning IT services with business needs across the service lifecycle/value system, covering practices such as incident, problem, change and service level management.

What is ISO/IEC 27001 and what is its core deliverable?

ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS). Its core requirement is establishing a risk-based ISMS with documented controls; organisations can be certified, and Annex A provides a catalogue of security controls (a Statement of Applicability documents which are used).

What is the COSO framework primarily used for?

The COSO (Committee of Sponsoring Organizations) framework provides guidance on internal control, enterprise risk management (ERM) and fraud deterrence. Its Internal Control–Integrated Framework defines five components: control environment, risk assessment, control activities, information & communication, and monitoring.

What is the 'three lines' model in governance and risk management?

First line: operational management who own and manage risks directly. Second line: risk and compliance functions that oversee and advise on risk. Third line: internal audit providing independent assurance to the governing body. It clarifies roles in managing and assuring risk.

What is the Network and Information Systems (NIS) Regulations 2018 about?

The NIS Regulations 2018 impose cybersecurity and incident-reporting duties on operators of essential services (e.g. energy, transport, water, health, digital infrastructure) and relevant digital service providers, to improve the resilience of critical network and information systems.

What is PCI DSS and to whom does it apply?

The Payment Card Industry Data Security Standard is a set of security requirements that applies to any organisation that stores, processes or transmits cardholder data. It is a contractual/industry standard (not statute) enforced by the card brands, covering requirements such as encryption, access control and network security.

What are PECR and how do they relate to UK GDPR?

The Privacy and Electronic Communications Regulations 2003 (PECR) sit alongside UK GDPR and govern electronic marketing (email, SMS, calls), cookies and similar technologies, and communications security. They require, for example, consent for non-essential cookies and for most electronic marketing.

What duties does the Equality Act 2010 place on organisations, and what are the protected characteristics?

The Equality Act 2010 prohibits discrimination and requires reasonable adjustments for disabled people. The nine protected characteristics are: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex, and sexual orientation.

What accessibility standard underpins UK public sector website obligations, and what conformance level is required?

The Web Content Accessibility Guidelines (WCAG) 2.1 (or 2.2) at conformance level AA. The Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018 require public sector websites and apps to meet WCAG AA and publish an accessibility statement.

What are the four guiding principles (POUR) of the Web Content Accessibility Guidelines (WCAG)?

Perceivable, Operable, Understandable, and Robust. Content and interfaces must be presentable to users in ways they can perceive, components must be operable, information and operation must be understandable, and content must be robust enough to work with assistive technologies.