Welcome to the Apex Global Bank case walkthrough. Apex Global Bank is a tier-1 financial institution serving 14 million retail customers and over 80,000 corporate accounts worldwide. Throughout this course, we examine how legal, ethical, and professional governance standards are operationalized in high-stakes financial environments.
Sarah is a senior database administrator at Apex Global Bank. During routine migration testing on the wealth management ledger, she notices that an unencrypted staging backup contains account balances and tax IDs for 50 prominent politicians and celebrities. No law explicitly prevents Sarah from querying this internal dataset, but doing so violates bank policy and professional ethics.
Information security professionals frequently operate at the intersection of what is legally required, what is organizationally mandated, and what is ethically right:
Formal rules adopted by governing authorities, enforced by civil litigation or criminal sanctions.
Moral principles and cultural standards that define acceptable conduct in the absence of explicit statutory commands.
Internal organizational mandates that function as internal law within the enterprise.
While Apex Global Bank creates strict internal security policies (such as the Acceptable Use Policy and Privileged Access Management Standard), an organizational policy does not carry criminal force on its own.
However, for an internal policy to be legally enforceable in employment disputes or wrongful termination lawsuits, it must satisfy five mandatory criteria:
In legal proceedings, ignorantia juris non excusat (ignorance of the law is no excuse). However, regarding internal company policy, an employee can successfully argue ignorance if the employer failed to distribute or obtain signed acknowledgment of the policy.
Apex Bank fires a junior loan officer for emailing customer credit reports to a personal Gmail account. In an arbitration hearing, the employee proves the Acceptable Use Policy was never provided during onboarding and no training was ever logged. How will the tribunal likely rule?