If executives are found liable for not properly protecting their company's assets and information systems, what type of law would apply in this situation?

Civil law addresses disputes between individuals or organizations where one party seeks compensation or remedy for harm caused by another's negligence or breach of duty. When executives fail to implement adequate security controls and the company suffers a breach, affected parties - shareholders, customers, or regulators - can pursue civil liability claims. Landmark cases and frameworks such as Sarbanes-Oxley establish the civil duty of care executives owe regarding information security governance.

International law governs relationships and disputes between sovereign nations and does not apply to corporate executive liability within a jurisdiction.

Criminal law requires government prosecution for acts deemed offenses against society; negligent security practices by executives are typically a civil matter unless fraud or willful misconduct rises to a criminal threshold.

Common law is a legal system based on court precedent rather than a category of liability; it is a source of law, not a type that contrasts with civil or criminal.