Learning Tools
Education · Advocacy · Activism

Education, Advocacy and Activism

Free training, tools and resources for journalists, advocates, activists and campaigns, with a focus on Idaho transparency, civic data and liberty.

A lock means the tool needs an account. Request one here.

🔒 Training: Privacy and Security

8 learning modules. This page updates itself when items move between sections.

Protecting yourself, your sources and your business: the privacy guide from five-minute settings to counter-surveillance, surveillance technology and the law, home computer and phone security for homeowners and seniors, small business data security, and digital safety for writers.

In this section
  1. Guarding Your Privacy Online and IRL Learning Module
  2. Surveillance Technology and Privacy Learning Module
  3. Securing Your Home Computer, Phone and Money: A Plain Guide for Homeowners and Seniors Learning Module
  4. Securing Your Small Business Data and Systems: A Guide for Owners and Office Staff Learning Module
  5. Digital Safety for Writers Learning Module
  6. Guarding Your Privacy Online and IRL: Counter-Surveillance and Privacy Tools from the Mundane to Hyper-Vigilance Learning Module
  7. Privacy and Data Security Laws Learning Module
  8. Privacy and Security for Small and Medium Businesses: A Management Guide to Layered Defense, Privacy Laws and Security Standards Learning Module

🛡️ Guarding Your Privacy Online and IRL Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

A free, practical guide to protecting your privacy online and in real life, from five-minute settings to hyper-vigilance: counter-surveillance and privacy tools. 9 lessons.

What is included: 8 lessons and pages
  1. The Privacy Ladder: Who Is Watching and How Far to Go 20 min
    Who actually collects data about ordinary people, how that data moves from your phone to ad auctions, brokers, government buyers and stalkers, and how to pick the level of protection that fits your life.
  2. Your Phone: How It Leaks and How to Close It 22 min
    How your phone knows where you are, how the advertising ID and app SDKs turn that into a product brokers sell, what police tools can pull from a phone, and the iPhone and Android settings that cut the leaks, up to Lockdown Mode, Advanced Protection and hardened phones.
  3. Browsing, Search and Email: How You Are Followed and How to Cut It 22 min
    How cookies, embedded trackers, fingerprinting, DNS lookups and email pixels follow you, what your internet provider and even privacy tools can see, what a VPN and Tor actually change, and the settings and tools that cut each leak.
  4. Messaging and Calls 22 min
    Who can read your texts, who can steal your phone number, what your call records reveal even when the words are encrypted, and how to cut each risk down, from free settings to a separate phone.
  5. Data Brokers, Credit and Identity 22 min
    How data brokers and people-search sites build a file on you, how breaches feed identity theft and synthetic identities, and what actually shrinks the risk: credit freezes, opt-outs, address control and, for survivors, Idaho's Address Confidentiality Program.
  6. Out in Public: Plate Readers, Face Scans, Events and Protests 22 min
    How plate reader networks store and share your drives, how store and venue face recognition goes wrong, how a geofence warrant sweeps up every phone near a scene, what changes on protest day, and what each defense does and costs, with the legal lines on plate covers, jammers, camera damage and masks.
  7. Vehicles, Travel and Trackers 22 min
    What a connected car records and who has bought it, how rental cars, tolls and loyalty programs build a travel trail, how hidden trackers are used for stalking and how phones now warn about them, and what CBP can do with your devices at the border, with what each defense does and costs.
  8. Hyper-Vigilance: When It Is Worth It and How to Do It Right 24 min
    Who is actually at risk of being tracked and by whom, how stalkerware and shared accounts work, how separate identities get linked back, what being followed looks like, and how Levels 4 and 5 answer each threat, with safety help for survivors and the full ladder with your own plan.
trainingprivacysurveillancecounter-surveillancesecurityalprphonebrowser

Quote Verification Last Ran (October 27, 2026)

Open Guarding Your Privacy Online and IRL ↗

📡 Surveillance Technology and Privacy Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

Learn how plate readers, face recognition, drones, phone tools and data brokers work, what the Fourth Amendment and state laws say about them, and how to judge a local surveillance program fairly using contracts, policies and audit logs. A module of Issues and Advocacy Training, 9 lessons.

What is included: 9 lessons and pages
  1. The Fourth Amendment in Eight Cases 16 min
    Learn the tests courts use to decide when watching, tracking or collecting data counts as a search, from Katz in 1967 to the 2026 geofence decision.
  2. How License Plate Readers Work 15 min
    Follow a single plate read from the camera to the hotlist check, the database, and the sharing network, and learn the numbers that matter.
  3. Plate Readers: Results, Misuse, Courts and Pushback 24 min
    Weigh the evidence on what plate readers do, the growing record of misuse including an Idaho sheriff's case, the court rulings turning against mass collection, and the cities and citizens pushing back.
  4. Facial Recognition: Accuracy, Arrests and Rules 16 min
    Learn how face recognition matches work, what NIST testing found about accuracy and demographic gaps, what went wrong in wrongful arrests, and how states regulate police use.
  5. Drones, Camera Networks and Real-Time Crime Centers 15 min
    See how police drones, public and private camera networks, and real-time crime centers fit together, and what federal and Idaho law says about drones.
  6. Phones: Cell-Site Simulators, Location Requests and Extraction Tools 16 min
    Learn how police locate phones, request location records from companies, and copy data off seized phones, and what legal process each step needs.
  7. Data Brokers and Police Purchases 15 min
    Learn how app location data reaches data brokers, why buying it can sidestep warrant rules, where federal legislation stands, and what the FTC has done.
  8. Private Surveillance: Doorbells, Partnerships and the Workplace 14 min
    Learn how doorbell camera companies route footage to police, what the FTC found about Ring, and what rules cover employers who monitor workers.
  9. Records to Request and How to Judge a Surveillance Program Fairly 18 min
    Know the records that exist for any surveillance program, read contracts and audit logs for the facts that matter, and hold police and privacy advocates to the same standard of proof.
moduleissuesprivacy and security

Quote Verification Last Ran (October 27, 2026)

Open Surveillance Technology and Privacy ↗

🏠 Securing Your Home Computer, Phone and Money: A Plain Guide for Homeowners and Seniors Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

Plain-language steps to protect your computer, phone, accounts and money at home and on the road: updates, passwords, two-step sign-in, Wi-Fi, email and browsing privacy, the common scams explained one by one, what to do in order when something goes wrong, and how to travel with your devices safely. A module of Issues and Advocacy Training, 11 lessons.

What is included: 11 lessons and pages
  1. Emergency cheat sheet: print and fill in your numbers
  2. What You Are Protecting, and Who Is After It 18 min
    What is really at stake on your home computer, phone and bank accounts, how harm usually happens, the layered idea in home terms, and the five habits that stop most of it.
  3. Updates, Antivirus and the Settings That Matter 22 min
    Turn on automatic updates, understand what the built-in antivirus does, deal with Windows 10 end of support, tidy your browser, use a standard account, lock your screen and scramble your disk.
  4. Passwords, Two-Step Sign-In and Passkeys 24 min
    How to make passwords that hold up, use a password manager (including free built-in ones), turn on two-step sign-in, try passkeys, keep recovery codes, and protect the accounts that matter first.
  5. Your Wi-Fi Router, Smart Devices and Public Wi-Fi 24 min
    Lock down the box that connects your whole house to the internet, sort out smart TVs, cameras, doorbells and printers, and learn what a firewall and a VPN really do.
  6. Email, Browsing and Online Privacy 22 min
    Why your email account is the master key to everything else, what secure email really means, and how to tame spam, trackers, ads, people-search sites and social media settings.
  7. Phones, Tablets and Apps 24 min
    How to lock your phone, guard your phone number against SIM swaps, control what apps can see, find a lost phone, spot text scams, and wipe an old phone properly.
  8. Common Scams Explained, One by One 38 min
    Sixteen scams that target homeowners and seniors, each with how it works, the tell, and what to do, plus a master warning-signs table and one simple rule: stop, hang up, and call back on a number you know.
  9. Money, Credit and Identity 26 min
    How to lock your credit file for free, check your credit reports, protect your tax and Social Security records, set up bank alerts, know which payments can be reversed, and keep thieves away from your mail and from a loved one's identity after a death.
  10. When Things Go Wrong: The First Hour, Day and Week 22 min
    What to do, in order, if you clicked a bad link, gave out a password or code, let a stranger onto your computer, sent money, gave your Social Security number, lost your phone or got hit by ransomware, and who to report it to.
  11. Travel and Public Places 22 min
    How to get your phone, laptop, cards and home ready before a trip, stay safe at airports, hotels, ATMs and in rental cars, handle a border device search in general terms, and clean up when you get home.
moduleissuesprivacy and security

Quote Verification Last Ran (October 27, 2026)

Open Securing Your Home Computer, Phone and Money: A Plain Guide for Homeowners and Seniors ↗

🗄️ Securing Your Small Business Data and Systems: A Guide for Owners and Office Staff Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

How a small business protects its local and cloud data in layers: accounts and two-step sign-in, computers and backups, SaaS and shared files, secure email and browsing defined, phones and mobile devices, the scams that target businesses, and an incident playbook for when something goes wrong. A module of Issues and Advocacy Training, 11 lessons.

What is included: 12 lessons and pages
  1. Emergency cheat sheet: print and fill in your numbers
  2. Your Data and Layered Defense 22 min
    Inventory what data a small business holds and where it lives, see why small firms get targeted, and learn the layered approach (prevent, detect, respond, recover) that the rest of the course builds.
  3. Accounts, Passwords and Two-Step Sign-In 24 min
    Give every person their own login, use a business password manager, turn on two-step sign-in in the right strength, separate admin accounts, and run onboarding and offboarding checklists so access ends when a job does.
  4. Computers, Local Data and Backups 26 min
    Inventory the machines, keep them updated and encrypted, tame file servers, USB drives and printers, dispose of old gear safely, and build a tested backup with an offline copy that survives ransomware.
  5. Cloud, SaaS and Shared Files 28 min
    Understand what the cloud and SaaS really are, who is responsible for what, how to set sharing, guest access and app connections in Microsoft 365 and Google Workspace, how to vet vendors, and how to back up and exit from the services your business runs on.
  6. Secure Email and Secure Browsing 22 min
    What secure email and secure browsing actually mean, how SPF, DKIM and DMARC stop people from faking your domain, and the mailbox and browser settings an office can fix in an afternoon.
  7. Network, Wi-Fi and Remote Work 22 min
    Lock down the router and Wi-Fi, split guests and devices onto their own networks, handle remote access and home workers without opening the front door, and cover the physical basics: locks, visitors and a clean desk.
  8. Phones, Tablets and Mobile Devices 22 min
    Company phones versus personal phones, the screen lock and update basics, what mobile device management is and the cheap versions you may already own, plus lost-phone steps, SIM-swap protection, text scams and leaving employees.
  9. Scams Aimed at Businesses 45 min
    The fraud that actually costs small firms money: fake vendor bank changes, boss and payroll requests, tech support and domain-renewal invoices, QR codes, ransomware extortion, voice clones and fake job applicants. Each scam gets how it works, the tell and the control, plus a callback procedure, a dual-approval rule and a playbook for the person at the front desk.
  10. Payment Cards, Customer Data and Records 24 min
    How to take cards without storing them, what PCI DSS asks of a small merchant, how to keep customer and employee records lean, and how long to keep and how to destroy what you hold.
  11. When Something Goes Wrong 26 min
    A plain incident plan for a small shop: the signs of trouble, what to do in the first hour, day and week, who to call, what to keep, the facts on ransomware payments and wire recalls, Idaho breach notice basics and a one-page incident card.
  12. Policies, Training and a 90-Day Plan 30 min
    A two-page security policy a 10-person shop can actually follow, 15-minute monthly training, kind phishing drills, cyber insurance basics, a vendor checklist, a 30/60/90-day plan, a rough budget table and a page of verified numbers and pictures.
moduleissuesprivacy and security

Quote Verification Last Ran (October 27, 2026)

Open Securing Your Small Business Data and Systems: A Guide for Owners and Office Staff ↗

🔐 Digital Safety for Writers Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

Build a plain-language security plan, then lock down your accounts, devices, sources, files and website so one bad day does not end your reporting. Includes what to do, in order, if you get hacked or harassed. A module of Journalism Training, 9 lessons.

What is included: 9 lessons and pages
  1. Threat Modeling in Plain Terms 14 min
    Write a one-page security plan by listing what you have, who might want it, how bad losing it would be and how much effort protection is worth.
  2. Passwords, Password Managers and Passkeys 15 min
    Stop reusing passwords, set up a password manager with one strong passphrase, and start replacing passwords with passkeys where sites allow it.
  3. Two-Factor Authentication and SIM-Swap Protection 15 min
    Rank the kinds of two-factor sign-in from weakest to strongest, move your key accounts off text-message codes, and lock your phone number at your carrier.
  4. Phishing and Social Engineering 16 min
    Spot fake messages and pretext calls aimed at writers, read a link's real domain, and verify any request through a channel you already trust.
  5. Device Security: Updates, Locks, Encryption and Travel 16 min
    Keep phones and laptops patched, locked and encrypted, plan for a lost or stolen device before it happens, and pack a lighter digital load when you travel.
  6. Talking to Sources Safely 17 min
    Protect the people who trust you: set up Signal properly, understand what email and metadata reveal, know what SecureDrop is for, and decide what never goes in writing.
  7. Protecting Files: Backups, Encryption and Ransomware 15 min
    Set up a 3-2-1 backup, decide what belongs in the cloud and what stays local, encrypt the copies, and make sure ransomware cannot take the backups with it.
  8. Doxxing and Online Harassment 17 min
    Shrink the personal information about you that is for sale online, lock down your social accounts, and know how to document, report and get support if harassment starts.
  9. Securing Your Site and Recovering From a Hack 18 min
    Lock your domain, hosting, CMS and newsletter accounts, then follow a step-by-step recovery plan if any account or your website is taken over.
moduletrainingprivacy and security

Quote Verification Last Ran (October 27, 2026)

Open Digital Safety for Writers ↗

📘 Guarding Your Privacy Online and IRL: Counter-Surveillance and Privacy Tools from the Mundane to Hyper-Vigilance Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

A practical guide to protecting your own privacy, online and in real life. Step-by-step settings and habits for your phone, accounts, home, car and travels, arranged from five-minute fixes anyone can make to the habits of people with real reasons to fear being tracked, with what each step costs and where the legal lines are. A module of a special edition, 9 lessons.

What is included: 8 lessons and pages
  1. The Privacy Ladder: Who Is Watching and How Far to Go 20 min
    Who actually collects data about ordinary people, how that data moves from your phone to ad auctions, brokers, government buyers and stalkers, and how to pick the level of protection that fits your life.
  2. Your Phone: How It Leaks and How to Close It 22 min
    How your phone knows where you are, how the advertising ID and app SDKs turn that into a product brokers sell, what police tools can pull from a phone, and the iPhone and Android settings that cut the leaks, up to Lockdown Mode, Advanced Protection and hardened phones.
  3. Browsing, Search and Email: How You Are Followed and How to Cut It 22 min
    How cookies, embedded trackers, fingerprinting, DNS lookups and email pixels follow you, what your internet provider and even privacy tools can see, what a VPN and Tor actually change, and the settings and tools that cut each leak.
  4. Messaging and Calls 22 min
    Who can read your texts, who can steal your phone number, what your call records reveal even when the words are encrypted, and how to cut each risk down, from free settings to a separate phone.
  5. Data Brokers, Credit and Identity 22 min
    How data brokers and people-search sites build a file on you, how breaches feed identity theft and synthetic identities, and what actually shrinks the risk: credit freezes, opt-outs, address control and, for survivors, Idaho's Address Confidentiality Program.
  6. Out in Public: Plate Readers, Face Scans, Events and Protests 22 min
    How plate reader networks store and share your drives, how store and venue face recognition goes wrong, how a geofence warrant sweeps up every phone near a scene, what changes on protest day, and what each defense does and costs, with the legal lines on plate covers, jammers, camera damage and masks.
  7. Vehicles, Travel and Trackers 22 min
    What a connected car records and who has bought it, how rental cars, tolls and loyalty programs build a travel trail, how hidden trackers are used for stalking and how phones now warn about them, and what CBP can do with your devices at the border, with what each defense does and costs.
  8. Hyper-Vigilance: When It Is Worth It and How to Do It Right 24 min
    Who is actually at risk of being tracked and by whom, how stalkerware and shared accounts work, how separate identities get linked back, what being followed looks like, and how Levels 4 and 5 answer each threat, with safety help for survivors and the full ladder with your own plan.
modulespecial edition: guarding your privacy

Quote Verification Last Ran (October 27, 2026)

Open Guarding Your Privacy Online and IRL: Counter-Surveillance and Privacy Tools from the Mundane to Hyper-Vigilance ↗

📘 Privacy and Data Security Laws Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

The federal and state privacy and data security laws in plain terms: what each one covers, who it binds, the rights it gives and how it is enforced, from the Privacy Act, HIPAA, GLBA, FERPA, COPPA and the wiretap laws to the state consumer privacy, biometric, health data and breach notice laws, with Idaho's statutes up close, every key term defined, real enforcement cases, and a short closing lesson on mitigation and best practices. A module of Issues and Advocacy Training, 11 lessons.

What is included: 11 lessons and pages
  1. The Terms and the Map 24 min
    How U.S. privacy law is built from sector laws, state laws, FTC Section 5 and the Constitution, and the exact statutory meaning of the words that decide who owes what: personal information, PII, sensitive data, PHI, NPI, education records, consumer reports, breach versus incident, encryption safe harbor, controller and processor, consent, sale, data broker, de-identified data, assessments and notice deadlines.
  2. The Privacy Act and Government Records 25 min
    How the Privacy Act of 1974 governs federal agency files: systems of records, SORNs, the 13 disclosure exceptions, routine uses, access and amendment rights, damages after Doe v. Chao and FAA v. Cooper, computer matching, privacy impact assessments, the Social Security number rule, FOIA's privacy exemptions, the 2025 and 2026 lawsuits over DOGE access to Social Security data, the Driver's Privacy Protection Act and …
  3. Health Privacy: HIPAA and Beyond 27 min
    HIPAA's Privacy, Security and Breach Notification Rules in depth: who is covered, what PHI is, minimum necessary, the patient's right of access, permitted disclosures, breach notice, the inflation-adjusted penalty tiers, state attorney general suits, OCR cases from Anthem to 2026 ransomware settlements, Change Healthcare, the vacated 2024 reproductive health rule, the stalled Security Rule update, 42 CFR Part 2, the…
  4. Money, Credit and Financial Data 24 min
    The Fair Credit Reporting Act, FACTA's Red Flags and Disposal Rules, Gramm-Leach-Bliley and Regulation P, the FTC Safeguards Rule and its 30-day breach notice, SEC Regulation S-P, New York's Part 500, the CFPB's open banking rule, and the Equifax and Capital One cases.
  5. Children and Students 24 min
    COPPA and the FTC's 2025 rule amendments, the record COPPA penalties, FERPA and the student records rights it gives parents and students, the PPRA, state student privacy laws on the California SOPIPA model, the court fights over age-appropriate design codes and age verification, and where KOSA and COPPA 2.0 stand as of October 2026.
  6. Wiretaps, Computers and Communications 25 min
    The Electronic Communications Privacy Act's three parts (the Wiretap Act, the Stored Communications Act and the Pen Register Act), one-party and all-party recording states, website tracking lawsuits under state wiretap laws, the Computer Fraud and Abuse Act after Van Buren, the Video Privacy Protection Act case now before the Supreme Court, and the TCPA and CAN-SPAM rules for calls, texts and email.
  7. The FTC and Federal Security Rules 26 min
    How the FTC turned Section 5 of the FTC Act into the country's main privacy and data security enforcer, what Wyndham, LabMD and AMG Capital did to its powers, the recent location data, facial recognition and connected car cases, and the other federal security rules: the SEC's four-business-day incident disclosure, CIRCIA's 72-hour reports, PADFA and the DOJ bulk data rule, the TikTok law, FCC carrier rules, the bank…
  8. State Consumer Privacy Laws 30 min
    California's CCPA and its privacy agency, then every state with a broad consumer privacy law as of October 2026 (23 states, 19 in effect), with citations, effective dates, thresholds, cure periods and enforcers; the Virginia model and where states depart from it; universal opt-out signals; data broker registries and California's DROP; biometric laws in Illinois, Texas, Washington and Colorado; and the state enforcem…
  9. Breach Notification Laws in All 50 States 28 min
    Every state, D.C., Puerto Rico, Guam and the U.S. Virgin Islands requires notice when personal information is breached. The parts every law shares, where they split (definitions, harm tests, encryption, deadlines, regulator and credit bureau notice, private suits), a 51-row table built from the statutes, the federal overlays, how to read a breach letter, and what to do after one arrives.
  10. Idaho Privacy Law Up Close 30 min
    Idaho has no broad consumer privacy law as of October 2026. What it has is a stack of narrower statutes: the breach law at Idaho Code 28-51-104 to 107, the student data law at 33-133, the Consumer Protection Act, the wiretap and identity theft crimes, the Genetic Testing Privacy Act, the 2024 age verification law, the 2025 license plate reader law, the 2026 social media and digital ID laws, and the bills from 2023 t…
  11. Mitigation and Best Practices 18 min
    The short closing lesson: what to do after a breach letter, how small businesses, nonprofits and campaigns can collect less, lock down accounts, encrypt, manage vendors and plan a response timed to the strictest law that applies, the frameworks to use, a one-page checklist, and the course's verified numbers in one place.
moduleissues and advocacy training

Open Privacy and Data Security Laws ↗

📘 Privacy and Security for Small and Medium Businesses: A Management Guide to Layered Defense, Privacy Laws and Security Standards Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

For owners, managers and executives of small and medium businesses: 18 lessons on building and governing a layered security and privacy program, which federal and state privacy and breach laws apply, how NIST CSF, CIS Controls, ISO 27001, SOC 2 and PCI DSS fit together, identity and device control, patching and your website, vendors, people, incidents, insurance, government contracts and sector rules, records retention and legal holds, and reporting risk to the board. A module of Issues and Advocacy Training, 18 lessons.

What is included: 18 lessons and pages
  1. Why Management Owns the Risk 22 min
    Privacy, security and compliance are three different jobs, and the law, regulators, customers and insurers all hold management, not the IT department, answerable for them. This lesson covers breach costs, the FTC Act, the reasonable security idea, director oversight, the roles every business needs and risk appetite.
  2. Layered Defense Architecture 24 min
    Defense in depth for a business of 10 to 500 people: eleven layers from governance to recovery, what each stops in an attack chain, zero trust in plain terms, maturity levels, and the minimum stack by company size with rough costs.
  3. Risk Assessment and Data Mapping: Know What You Have Before You Rank What Can Hurt It 28 min
    How a manager builds an asset inventory, classifies data, draws data flow maps, scores risks with a likelihood and impact scale, keeps a risk register, chooses to treat, transfer, accept or avoid each risk, signs off residual risk, and decides how often to repeat the work.
  4. Security Frameworks and Standards: NIST CSF, CIS, ISO 27001, SOC 2 and CMMC 24 min
    What NIST CSF 2.0, CIS Controls v8.1, ISO/IEC 27001:2022, SOC 2, NIST SP 800-171 with CMMC, HITRUST and FedRAMP each are, which ones a customer or a contract can force on you, and how a manager chooses between a framework, a certification and an attestation.
  5. PCI DSS and Payment Security: The Contract Standard Behind Every Card Swipe 24 min
    PCI DSS v4.0.1 for managers: who must comply, how merchant levels and SAQ types work, the 12 requirements, the March 31, 2025 future-dated items, scoping and tokenization, how penalties really arrive, and what Nevada, Washington and Minnesota do with card data.
  6. Federal Laws That Reach Your Business: FTC, GLBA, HIPAA, FCRA, COPPA, CAN-SPAM, TCPA, Wiretap, SEC and CIRCIA 30 min
    Which federal privacy and security laws actually bind a business of 10 to 500 people, what each demands in plain terms, the notice clocks that start when something goes wrong, a decision table for 'which law applies to me,' and where each rule stands as of October 2026.
  7. State Privacy, Breach Notice and Data Security Laws: What Bites on a Business 26 min
    How the 50 state breach notice laws work, Idaho Code 28-51-104 to 107 in detail, where Idaho stands on a full consumer privacy law as of October 2026, the 23 states that have one, California's CCPA and its new audit rules, the sector laws (health data, biometrics, AI) and the state data security statutes, plus a multi-state strategy and its limits.
  8. International Privacy for US Businesses: GDPR, UK, Canada and Website Tracking 28 min
    When a small or mid-size US company falls under the EU GDPR, UK GDPR, Canada's PIPEDA or Quebec's Law 25, how personal data legally moves from Europe to the United States, what the EU-US Data Privacy Framework's legal status is as of October 2026, and how cookie banners, tracking pixels and California wiretap suits fit in.
  9. Vendors, Contracts and Third-Party Risk 30 min
    How a 10 to 500 person business inventories and tiers its vendors, reads a SOC 2 report, writes the contract clauses that the FTC Safeguards Rule, HIPAA, GDPR and Idaho law point to, controls SaaS sprawl and software supply chain risk, handles acquisitions, and answers the security questionnaires customers send.
  10. People, Policies and Training 28 min
    The policy set a 10-to-500-person business needs, how policy, standard and procedure differ, training and phishing simulations that work, insider risk, hiring and offboarding within the law, and what employee monitoring law allows.
  11. Detection, Incident Response and Notification 32 min
    Who watches the alerts, what an incident response plan must contain, how to run a tabletop exercise, which notice clocks start when you discover a breach, what the ransomware payment rules say, and how to work with the FBI, CISA and the Secret Service.
  12. Continuity, Recovery and Cyber Insurance 32 min
    How to run a business impact analysis, set recovery time and recovery point targets, build backups that survive ransomware and prove it with restore tests, and how cyber insurance works, what it excludes, what the application commits you to, and how to read a policy.
  13. Privacy Program, AI Governance and Board Reporting 32 min
    The working parts of a business privacy program, how to govern generative AI and shadow AI, where the state AI laws stand as of October 2026, how to control deepfake and voice-clone fraud, and how to report all of it to a board with a dashboard, a budget and a 12-month plan.
  14. Identity, Access and Device Control 32 min
    Who can get in, from what device, and for how long: single sign-on, the MFA strength ladder, joiner-mover-leaver and access reviews, admin and break-glass accounts, zero trust as a decision table, personal-device governance, and physical access and disposal.
  15. Vulnerabilities, Patching and Your Website 32 min
    How a 10-to-500-person business runs a patch and vulnerability program it can prove: severity-based deadlines built on the CISA Known Exploited Vulnerabilities list, scans versus penetration tests, end-of-life equipment, edge devices, domain and email hygiene, website and e-commerce security, secure software basics for firms that build for clients, and the metrics that show it works.
  16. Contracts That Raise the Bar: Federal and Defense Work, Idaho Public Sector and Sector Snapshots 36 min
    How FAR 52.204-21, DFARS 252.204-7012, SPRS scores, NIST SP 800-171 and CMMC reach a small contractor and its subcontractors as of October 2026, including the July 2026 suspension of CMMC Phase 2, plus what Idaho state and local agencies expect from vendors, what the Idaho Public Records Act can do to your proposal, and a sector snapshot for health, finance, education, HR, construction, tax and nonprofit managers.
  17. Records, Retention, Legal Holds and Workplace Privacy 32 min
    How to build a retention schedule from the federal minimums, stop deletion with a legal hold when a dispute or audit is coming, delete on purpose and prove it, and run employee monitoring, biometrics and children's data under one set of rules.
  18. Running the Program 45 min
    How to choose and contract an MSP, MSSP, MDR or virtual CISO, set a security budget in three tiers, prepare for cyber insurance underwriting, measure the program with 15 metrics, map one control to eight standards, and look up any term or deadline in the course.
moduleissues and advocacy training

Quote Verification Last Ran (October 27, 2026)

Open Privacy and Security for Small and Medium Businesses: A Management Guide to Layered Defense, Privacy Laws and Security Standards ↗

Other sections