In CEH v13 Module 01: Introduction to Ethical Hacking, the types of law applicable to cybersecurity incidents are discussed. When executives fail to protect their company’s information systems and this leads to financial loss, data breaches, or negligence, the resulting liability is considered under civil law.

Civil law deals with non-criminal disputes such as negligence, liability, and contractual breaches.

A company or affected party may file a civil lawsuit for damages.

Executives can be held civilly liable for failing in their duty of care, especially when regulations like GDPR, SOX, or HIPAA are involved.