As part of the IEEE Meta Issues in Cybersecurity project, this paper focuses on the legal aspects of cybersecurity. It provides an overview of the ways in which law creates rules, responsibilities, and obligations relevant to cybersecurity, and the limitations of the law in this context. While there is no standardized approach to regulating cybersecurity globally, Australia is used as an example to illustrate the patchwork of legal frameworks that have relevance to different aspects of cybersecurity. Law can be effective in imposing obligations on a range of stakeholders to help ensure effective cybersecurity measures and practices; however, there continue to be challenges in using law to advance cybersecurity. These include enforcing the law against those engaged in criminal activities that undermine cybersecurity, and the national security interests that nation-states can have in developing capabilities that undermine cybersecurity.