🏛️ Issues and Advocacy Training™
Courses

Data, privacy and safety

🛡️ Privacy and Security for Small and Medium Businesses: A Management Guide to Layered Defense, Privacy Laws and Security Standards™

For owners, managers and executives of small and medium businesses: 18 lessons on building and governing a layered security and privacy program, which federal and state privacy and breach laws apply, how NIST CSF, CIS Controls, ISO 27001, SOC 2 and PCI DSS fit together, identity and device control, patching and your website, vendors, people, incidents, insurance, government contracts and sector rules, records retention and legal holds, and reporting risk to the board.

18 lessons · about 9 hours ·

Start lesson 1

  1. 1Why Management Owns the RiskPrivacy, security and compliance are three different jobs, and the law, regulators, customers and insurers all hold management, not the IT department, answerable for them. This lesson covers breach costs, the FTC Act, the reasonable security idea, director oversight, the roles every business needs and risk appetite.22 min
  2. 2Layered Defense ArchitectureDefense in depth for a business of 10 to 500 people: eleven layers from governance to recovery, what each stops in an attack chain, zero trust in plain terms, maturity levels, and the minimum stack by company size with rough costs.24 min
  3. 3Risk Assessment and Data Mapping: Know What You Have Before You Rank What Can Hurt ItHow a manager builds an asset inventory, classifies data, draws data flow maps, scores risks with a likelihood and impact scale, keeps a risk register, chooses to treat, transfer, accept or avoid each risk, signs off residual risk, and decides how often to repeat the work.28 min
  4. 4Security Frameworks and Standards: NIST CSF, CIS, ISO 27001, SOC 2 and CMMCWhat NIST CSF 2.0, CIS Controls v8.1, ISO/IEC 27001:2022, SOC 2, NIST SP 800-171 with CMMC, HITRUST and FedRAMP each are, which ones a customer or a contract can force on you, and how a manager chooses between a framework, a certification and an attestation.24 min
  5. 5PCI DSS and Payment Security: The Contract Standard Behind Every Card SwipePCI DSS v4.0.1 for managers: who must comply, how merchant levels and SAQ types work, the 12 requirements, the March 31, 2025 future-dated items, scoping and tokenization, how penalties really arrive, and what Nevada, Washington and Minnesota do with card data.24 min
  6. 6Federal Laws That Reach Your Business: FTC, GLBA, HIPAA, FCRA, COPPA, CAN-SPAM, TCPA, Wiretap, SEC and CIRCIAWhich federal privacy and security laws actually bind a business of 10 to 500 people, what each demands in plain terms, the notice clocks that start when something goes wrong, a decision table for 'which law applies to me,' and where each rule stands as of October 2026.30 min
  7. 7State Privacy, Breach Notice and Data Security Laws: What Bites on a BusinessHow the 50 state breach notice laws work, Idaho Code 28-51-104 to 107 in detail, where Idaho stands on a full consumer privacy law as of October 2026, the 23 states that have one, California's CCPA and its new audit rules, the sector laws (health data, biometrics, AI) and the state data security statutes, plus a multi-state strategy and its limits.26 min
  8. 8International Privacy for US Businesses: GDPR, UK, Canada and Website TrackingWhen a small or mid-size US company falls under the EU GDPR, UK GDPR, Canada's PIPEDA or Quebec's Law 25, how personal data legally moves from Europe to the United States, what the EU-US Data Privacy Framework's legal status is as of October 2026, and how cookie banners, tracking pixels and California wiretap suits fit in.28 min
  9. 9Vendors, Contracts and Third-Party RiskHow a 10 to 500 person business inventories and tiers its vendors, reads a SOC 2 report, writes the contract clauses that the FTC Safeguards Rule, HIPAA, GDPR and Idaho law point to, controls SaaS sprawl and software supply chain risk, handles acquisitions, and answers the security questionnaires customers send.30 min
  10. 10People, Policies and TrainingThe policy set a 10-to-500-person business needs, how policy, standard and procedure differ, training and phishing simulations that work, insider risk, hiring and offboarding within the law, and what employee monitoring law allows.28 min
  11. 11Detection, Incident Response and NotificationWho watches the alerts, what an incident response plan must contain, how to run a tabletop exercise, which notice clocks start when you discover a breach, what the ransomware payment rules say, and how to work with the FBI, CISA and the Secret Service.32 min
  12. 12Continuity, Recovery and Cyber InsuranceHow to run a business impact analysis, set recovery time and recovery point targets, build backups that survive ransomware and prove it with restore tests, and how cyber insurance works, what it excludes, what the application commits you to, and how to read a policy.32 min
  13. 13Privacy Program, AI Governance and Board ReportingThe working parts of a business privacy program, how to govern generative AI and shadow AI, where the state AI laws stand as of October 2026, how to control deepfake and voice-clone fraud, and how to report all of it to a board with a dashboard, a budget and a 12-month plan.32 min
  14. 14Identity, Access and Device ControlWho can get in, from what device, and for how long: single sign-on, the MFA strength ladder, joiner-mover-leaver and access reviews, admin and break-glass accounts, zero trust as a decision table, personal-device governance, and physical access and disposal.32 min
  15. 15Vulnerabilities, Patching and Your WebsiteHow a 10-to-500-person business runs a patch and vulnerability program it can prove: severity-based deadlines built on the CISA Known Exploited Vulnerabilities list, scans versus penetration tests, end-of-life equipment, edge devices, domain and email hygiene, website and e-commerce security, secure software basics for firms that build for clients, and the metrics that show it works.32 min
  16. 16Contracts That Raise the Bar: Federal and Defense Work, Idaho Public Sector and Sector SnapshotsHow FAR 52.204-21, DFARS 252.204-7012, SPRS scores, NIST SP 800-171 and CMMC reach a small contractor and its subcontractors as of October 2026, including the July 2026 suspension of CMMC Phase 2, plus what Idaho state and local agencies expect from vendors, what the Idaho Public Records Act can do to your proposal, and a sector snapshot for health, finance, education, HR, construction, tax and nonprofit managers.36 min
  17. 17Records, Retention, Legal Holds and Workplace PrivacyHow to build a retention schedule from the federal minimums, stop deletion with a legal hold when a dispute or audit is coming, delete on purpose and prove it, and run employee monitoring, biometrics and children's data under one set of rules.32 min
  18. 18Running the ProgramHow to choose and contract an MSP, MSSP, MDR or virtual CISO, set a security budget in three tiers, prepare for cyber insurance underwriting, measure the program with 15 metrics, map one control to eight standards, and look up any term or deadline in the course.45 min