Running the Program

Seventeen lessons in, the module has covered what to protect, which laws and standards apply, and how to detect, respond and recover. A manager still has to answer plain questions on a Monday. Who do we hire to run this? What should it cost? What will the insurer check? How will I know in March whether we are better off than we were in December? Which of the eight standards do I owe, and can one piece of evidence cover several?

This lesson answers those. It leans on earlier lessons rather than repeating them. The cyber insurance coverage terms live in lesson 12. The board dashboard and the rough 12-month plan live in lesson 13. Notification clocks stay canonical in lesson 11. The hands-on side for very small offices is in the small business data security module.

Choosing an MSP, MSSP, MDR service or vCISO

The labels below are the author's plain definitions. No standards body fixes them, and a vendor may use "MSSP" for a service you would call MDR. Read the service description, not the logo.

Job	MSP	MSSP	MDR	vCISO	You (inside the company)
Help desk, user accounts, laptops	Usually yes	No	No	No	Approves who gets access
Patching and backups	Usually yes	Sometimes	No	Sets the standard and checks it	Owns the restore test sign-off
Firewall, email filter and endpoint tool management	Often	Yes	Tooling is part of the service	Chooses the standard	Owns the budget
Watching alerts day and night	Rarely, and seldom at night	Yes, for the tools it manages	Yes, with response actions	No	Decides who is called at 2 a.m.
Incident response and forensics	Basic containment	Varies	Containment and investigation help	Runs the plan and the exercise	Makes the business decisions and the notices
Risk assessment, policies, vendor reviews	No, or as an add-on	No	No	Yes	Signs and funds
Insurance and customer questionnaires	Supplies technical answers	Supplies technical answers	Supplies detection facts	Assembles and reviews evidence	Signs the application
Board reporting	No	No	Incident summaries	Yes	Presents

The matrix shows why buying everything from one MSP is common and risky. The same party that configures the firewall, holds the admin keys and writes the monthly report is also the party being graded. It has every reason to report green. A vCISO or an internal owner who is not paid by the MSP can check the claims. A 25-person firm that cannot afford that separation can still get part of it by keeping one thing out of the provider's hands: your own tenant ownership and two emergency administrator accounts, described below.

The MSP is a single point of compromise

An MSP's management tools usually hold privileged access to every client. If an attacker takes that access, they reach all the clients at once. The joint advisory AA22-131A, issued May 11, 2022 by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency, the FBI and the cyber agencies of the United Kingdom, Australia, Canada and New Zealand, was written for this reason. I read it through the UK National Cyber Security Centre's hosted copy because CISA's own page did not load in this session. Its recommendations for customers translate into contract terms.

What the advisory recommends for customers	Contract term it becomes
Contracts should "transparently identify ownership of ICT security roles and responsibilities"	A responsibility matrix attached to the contract, naming who patches, who monitors, who responds and who decides
Require MFA on the services received and on all MSP accounts used to access customer environments	MFA on every provider technician account, with phishing-resistant methods for administrator accounts if your tools support them
Use a dedicated VPN or other secure access method for MSP connections; MSP accounts should not sit in internal administrator groups; MSPs should not reuse admin credentials across customers	Named individual accounts, least privilege, one access path you can switch off, and a ban on shared credentials
If the MSP monitors and logs, require visibility into the provider's activity and notice of confirmed or suspected events	Access to a log of what the provider did in your environment, and an incident notice clause with a time limit
Require automatic and continuous backup of critical data and configurations, kept somewhere easily retrievable	Backup scope list, location, retention and a restore test schedule you can witness
Understand the MSP's patching policy and its own vendors and subcontractors	A patch timetable, a subcontractor list and notice of changes to it
Disable MSP accounts when the contract ends	An exit clause with credential removal and a confirmation within a set number of days
Both parties: keep key logs for at least six months; run endpoint detection and network monitoring	Log retention of six months or longer, exportable to you

The contract terms that matter, one row at a time

Clause	What to write	Why	How you test it
Tenant and license ownership	Your cloud tenants, domains, DNS, licenses and backup vaults are registered to your company. The provider is a delegated administrator.	If the relationship sours, you cannot be locked out of your own email or domain.	Log in as your own global administrator and read the tenant owner field.
Emergency administrator accounts	Two accounts held by your company, long unique credentials stored offline, MFA that does not depend on the provider, alerts when used.	Recovery when the provider is unavailable or compromised.	Use one in a drill. Confirm the alert fires.
Responsibility matrix	A table, attached, of who handles each task, per CISA's advice to identify ownership transparently.	Gaps hide in "we thought you had that."	Compare it with lessons 02, 11 and 12 and mark the blank cells.
Service levels	Response and resolution times by severity, hours of coverage, and credits when missed.	An alert answered at 9 a.m. is not a night service.	Review last quarter's ticket report against the numbers.
Incident notice to you	The provider tells you of confirmed or suspected events in your environment within a stated number of hours. Many buyers write 24 hours or less; no regulation sets this figure for private contracts.	Your own clocks (lesson 11) start when you know, and the provider may know first.	Run a tabletop where the provider injects a fake alert and time the call.
Logging	Provider logs and your logs kept at least six months, exportable in a standard format on request.	Matches the six-month baseline in AA22-131A; investigators need history.	Request an export and open it.
Credential handling	No shared credentials across customers, named technician accounts, MFA, password vault with audit trail, offboarding of technicians within a day of departure.	One stolen technician login is the entry point in a provider-wide attack.	Ask for the technician access list and compare it with the provider's staff list.
Subcontractors	Named list, notice before changes, same security duties flowed down.	Your data sits with parties you never met.	Read the list. Look up each name.
Assurance reports	Current SOC 2 Type 2 report or ISO/IEC 27001 certificate that covers the services you buy, with the scope statement and exceptions list.	A report on the provider's head office tells you little about the tool that touches your network (lesson 04).	Read the scope, the period covered and any exceptions.
Provider insurance	Technology errors and omissions and cyber coverage, with limits stated and a certificate on file.	Your recovery from a provider mistake depends on its ability to pay.	Match the certificate to the contract limit.
Liability and indemnity	Read the cap and the carve-outs. Many service contracts cap liability at fees paid over a recent period; this is common practice, not a rule, and I could not source a standard figure.	A cap of 12 months of fees is small against a six-figure incident.	Compare the cap with your lesson 12 loss estimate.
Regulated data	Where HIPAA applies, a business associate agreement (lesson 09). Where the Safeguards Rule applies, contractual safeguards and periodic assessment of the provider (16 CFR 314.4(f)).	These duties stay with you when work is outsourced.	Confirm the agreement exists and is signed before work starts.
Term, renewal and exit	Renewal notice no longer than 60 days, data return in a usable format within a stated period, credential removal confirmed in writing, transition help at stated rates.	Exit terms are priced low at signing and high at departure.	Ask for the exit cost in dollars before signing.
Key people and continuity	Named lead engineer, backup contact, and a plan if the firm is sold.	Small providers depend on two or three people.	Ask what happens if the lead engineer leaves.

Red flags and references

• The provider holds the only global administrator account, and the contract says the provider owns the tenant.
• No MFA on the provider's own tools, or technicians who share one login.
• A fixed price for "unlimited security" with no response times, no list of what is monitored and no named responsibilities.
• Refusal to show a current assurance report, a scope statement or a certificate of insurance.
• Reports that arrive as a single color-coded score with no raw counts behind them.
• An automatic renewal with a long notice period and a data return fee that is not stated.
• No answer when you ask which subcontractors touch your data.

Ask for three references: a client of your size, a client that left, and a client that lived through an incident. A provider that cannot offer the second and third is telling you something. Call each and ask what happened the first time something went wrong, and how long the provider took to say so.

Budgeting: three tiers for a company of 10 to 500 people

No government agency publishes a standard security budget for companies this size. Percent-of-revenue rules circulate widely and most come from vendors. The sourced figure I can give is from a survey of chief information security officers by IANS Research and Artico Search, released September 5, 2024 and summarized by Cybersecurity Dive: security was 13.2 percent of the IT budget in 2024 and 8.6 percent in 2020. The sample was 750 CISOs, of whom 681 answered the budget questions. The article gives no breakdown by company size and no percentage of revenue. A company that has a CISO on staff spends differently from a 60-person firm with a vCISO, so use the figure as a sanity check on direction, not as a target.

Tie the tier to company size

Lesson 02 set three size bands and a minimum viable stack for each. The tiers here are budget envelopes that sit on top of those stacks.

Tier	Who it fits	What it buys	What it leaves open
Lean	10 to 25 people, no regulated data, low customer demand for proof	MFA with hardware keys for administrators and finance, password manager, short training, immutable backup, written one-page incident card, insurance application evidence kept in a folder	No one watching alerts at night; no independent test; the owner is the security lead
Standard	25 to 150 people, some regulated data or customer questionnaires	Lean plus managed detection and response, a vCISO for a few hours a month, an external vulnerability scan, quarterly access review, annual tabletop	Annual penetration test is not funded; limited vendor reviews
Strong	100 to 500 people, regulated data, or contracts that demand attestation	Standard plus keys for every employee, annual external penetration test, facilitated tabletops, more vCISO hours, an assurance report or certification project	Little. The risk register drives the next dollar

Build or buy

Function	Build (inside)	Buy (outside)	Rule of thumb
Help desk and patching	Needs at least two people to cover absence	MSP	Buy below about 75 people unless you already employ a team
24-hour alert watching	Needs about five to six people to staff nights and weekends; I could not source an exact figure	MDR	Buy almost always; no mid-sized firm staffs this cheaply
Security leadership	Full-time CISO salary and benefits	vCISO	Buy until the program needs daily direction, then hire
Penetration testing	Possible, but you lose independence	Outside tester	Buy; independence is the product
Policies and training content	Own the content	Templates and a training platform	Buy the platform and edit the content to fit your business
Incident response retainer	Not realistic	Insurer panel firm or retainer	Buy, and check the retainer firm is on the insurer's panel (lesson 12)

vCISO pricing varies. One vendor that sells vCISO services, SideChannel, publishes a guide with monthly retainers of $1,500 to $4,000 for companies of 1 to 50 employees, $3,000 to $7,000 for 50 to 200, and $5,000 to $12,000 for 200 to 500. The same guide quotes $200 to $400 an hour for ad hoc advisory work. Treat it as vendor marketing and compare at least two quotes; the article contradicts itself in places. Lesson 02 shows a rough range of $1,500 to $6,000 a month for the same service, and the two overlap.

Cyber insurance underwriting: how your answers get scored

Lesson 12 explains what a policy covers, where it excludes, and why the application is a statement of fact. This section covers how to prepare for the underwriter's look at you. Underwriting is the insurer's process of judging your risk from the application, from any outside scan of your internet footprint, and from evidence you supply, then setting price, limits and conditions.

What the application tends to ask

Carrier forms differ, and I could not read a single carrier's current form in this session, so the table reflects common categories described in lesson 12 and in broker and carrier material rather than one source. Use it to build your evidence folder, then compare it with the actual form.

Area	Typical question	Evidence to keep, dated	Owner
Identity	Is MFA required for email, remote access and all administrator accounts? For what share of users?	Identity provider report showing MFA status by account, with the date	IT lead
Endpoint	Is endpoint detection and response installed on all endpoints and servers? Is anyone watching it at night?	Console coverage report, MDR contract and escalation path	IT lead
Backups	Are backups offline or immutable, separated from the main network, and tested?	Backup settings screenshot, last restore test report with time to restore	IT lead
Patching	How quickly are critical patches applied? Any end-of-life systems reachable from the internet?	Patch report, exception list with owner and date	IT lead
Email security	Is email filtered? Are SPF, DKIM and DMARC set to enforce?	DNS records and filter console	IT lead
Funds transfer	Is there a call-back and dual approval for payment changes?	Written procedure, a log of recent call-backs	Finance lead
Training and response	Is there training, and a tested incident plan with an insurer contact?	Completion records, tabletop notes	Security lead
Data and revenue	How many personal records, card transactions and what revenue?	Data map (lesson 03), PCI scope summary (lesson 05)	Privacy lead
History	Any incidents, claims or known circumstances?	Incident log with dates	Security lead

What an outside scan can see

Anyone on the internet can look at the parts of your network that answer back. Insurers and brokers commonly use such looks at quote and renewal; I could not confirm any specific carrier's method from a primary source, so treat that as widespread practice rather than a fact about your carrier. What a scan can see is technical and easy to list:

• Open remote desktop or file-sharing ports, and login pages for VPNs or firewalls.
• The software version a firewall or VPN device announces, and whether it matches a known-exploited flaw.
• Whether your domain publishes SPF, DKIM and DMARC records, and at what policy.
• Expired or weak certificates on public sites.
• Credentials from your domain that appear in public breach dumps.

At-Bay, a cyber insurer, reported in its 2026 InsurSec Report (published April 22, 2026, covering 2025 claims across more than 100,000 policy years) that the Akira ransomware group accounted for more than 40 percent of its ransomware claims in 2025, that 86 percent of Akira attacks occurred where a SonicWall device was present, and that it links higher risk to exposed on-premise remote access appliances generally. It also reported claim frequency up 7 percent, the highest since 2021, an average claim severity of $221,000, and financial fraud as the most common incident type at 30 percent of claims with an average loss of $285,000. This is one carrier's portfolio, so it is vendor data, not a market statistic. It does explain why underwriters look hard at remote access devices and payment procedures.

CISA offers free scanning of internet-facing assets, but eligibility is limited. Its Cyber Hygiene vulnerability scanning and web application scanning are open to U.S. federal, state, local, tribal and territorial governments and to public and private sector critical infrastructure organizations. The page does not mention other small businesses. If your firm qualifies as critical infrastructure, you can sign up by emailing vulnerability@cisa.dhs.gov with the subject "Requesting Cyber Hygiene Services." Otherwise a commercial external scan gives you a similar view to the one an underwriter may have. I could not source a price for one, so get quotes; the $3,000 in the worked example below is a planning estimate.

A renewal calendar

When	Do this	Evidence produced
120 days before renewal	Run an external scan. Close anything it finds. Read last year's application against today's facts.	Scan report, list of changes since last year
90 days	Refresh the evidence folder: MFA report, EDR coverage, backup and restore test, patch report, DMARC record.	Dated exports
60 days	Meet the broker. Compare the new form with the folder. Mark every answer "yes," "partly" or "no" with the evidence reference.	Completed answer sheet
45 days	Technical owners sign the answer sheet. The executive who signs the application reads it.	Sign-off sheet, one line per answer
30 days	Submit. Answer follow-up questions in writing and keep copies.	Submitted application and correspondence
Bind date	Read declarations, sublimits and conditions against lesson 12's checklist.	Policy review notes
After bind	Add a calendar item for any control the application says will be finished by a date. Report lapses to the broker.	Change log

Metrics: 15 measures that run the program

Lesson 13 gave you a one-page board dashboard of eight indicators. This section is the catalog behind it. Every metric below has a definition, a target, a data source and one owner. NIST published its measurement guide, SP 800-55, as two final volumes in December 2024. Volume 1 covers identifying and selecting measures. Volume 2 covers developing a measurement program, with a workflow for tying results to leadership decisions. The advice in both is plain: pick a few measures you will act on, write down how each is computed, and drop the ones nobody uses.

A leading indicator describes what you are doing now and predicts later results. A lagging indicator counts outcomes after they happen. You need both. Lagging counts such as incidents are what the board feels, but they arrive too late to steer by.

#	Metric	Type	Definition	Sample target	Data source	Owner
1	MFA coverage	Leading	Active accounts with MFA enforced divided by all active accounts; report phishing-resistant MFA separately for administrators and finance	100 percent of administrators and finance; 98 percent or more of all	Identity provider report	IT lead
2	Orphaned and dormant accounts	Leading	Enabled accounts belonging to departed staff or unused for 45 days	0 orphaned; dormant reviewed monthly	Identity provider and HR roster	IT lead with HR
3	Time to remove leaver access	Leading	Median hours from separation time to disabled sign-in and revoked sessions	Under 4 hours	HR ticket and identity log	HR lead
4	Critical patch compliance	Leading	Critical patches applied within the service level, divided by all critical patches due	95 percent or more within 14 days; PCI scope within one month (PCI 6.3.3)	Patch tool	IT lead
5	Internet-facing end-of-life assets	Leading	Count of public-facing devices or software no longer supported by the maker	0, or each with a dated exception	External scan, asset inventory	IT lead
6	Endpoint coverage	Leading	Endpoints reporting to the detection tool in the last 7 days, divided by endpoints in inventory	98 percent or more	Console and inventory	IT lead
7	Restore test result	Leading	Date of the last full restore of a critical system, pass or fail, and hours taken against the recovery time target	Quarterly; time under the target	Test record	IT lead
8	Phishing report rate and triage time	Leading	Reports per 100 staff per quarter, and median minutes to triage	Rising reports; under 30 minutes	Mailbox report button, ticket log	Security lead
9	Top-tier vendors with a current review	Leading	Tier 1 vendors with a security review under 12 months old, divided by all Tier 1 vendors	100 percent	Vendor register (lesson 09)	Procurement
10	High risks past their treatment date	Leading	Register entries rated high with a treatment date already passed	0	Risk register (lesson 03)	CEO or risk owner
11	Policy exceptions open past expiry	Leading	Approved exceptions to policy that have run beyond their end date	0	Exception log	Security lead
12	Insurance evidence currency	Leading	Application answers backed by evidence less than 90 days old, divided by all answers	100 percent at the 60-day mark before renewal	Evidence folder	Finance lead
13	Time to detect and contain	Lagging	Median hours from first malicious activity to detection, and from detection to containment, for incidents in the period	Falling trend; targets set after two quarters of data	Incident records (lesson 11)	Security lead
14	Incidents and near misses	Lagging	Count by type, with cost and the fix recorded for each	No target on count; target 100 percent with a recorded lesson	Incident log	Security lead
15	Funds transfer attempts caught	Lagging	Fraudulent or altered payment requests stopped by call-back or dual approval, and any that were paid	0 paid	Accounts payable log	Finance lead

A few cautions. A target is a management decision, so the numbers in the table are samples to adjust. A metric with no owner is a decoration. And a perfect score on one measure can hide a gap in another: 100 percent MFA coverage means little if 40 shared accounts sit outside the count.

Quarterly board report skeleton

Section	Contents	Length	Source
1. Decisions requested	Money, risk acceptances and policy approvals needed this quarter, each with a dollar figure and a recommendation	Half a page	CEO and security lead
2. Dashboard	Six to eight metrics from the catalog, trend against last quarter, target, owner	One page	Lesson 13 sample, metrics above
3. Incidents and near misses	Facts, cost, what changed afterward. No blame language.	Half a page	Incident log
4. Risk register movement	New high risks, risks closed, risks accepted with the signer's name	Half a page	Risk register
5. Third parties	Provider assurance reports received, exceptions found, changes of MSP or key vendors	Half a page	Vendor register
6. Law and customer changes	New rules, customer questionnaires, insurer changes, with the date each applies	Half a page	Lessons 06, 07 and 12
7. Next 90 days	Three to five items with owners and dates	Quarter page	Roadmap

Where the Safeguards Rule applies, the Qualified Individual must report in writing to the board or equivalent body at least annually, covering program status, compliance and material matters such as risks, testing, service provider arrangements and security events (16 CFR 314.4(i)). The skeleton above gives you that report four times a year, with the fourth edition doubling as the annual written one.

The standards crosswalk

A crosswalk is a table that maps one control to the matching items in several standards. Its payoff is practical. If you collect a dated MFA coverage report once, it answers the insurer, the customer's SOC 2 questionnaire, your PCI assessor, your HIPAA risk analysis and the Safeguards Rule file together, because each standard asks about MFA in its own words.

Read these warnings first. This crosswalk is the author's own mapping at the level of requirement families and well-known requirement numbers. It is not an official mapping. The official ones are NIST's CSF 2.0 informative references, and the mapping files CIS says it publishes among its resources (the CIS v8.1 page points to "companion guides, policy templates, mappings, and more" on its resources page). Before you put a crosswalk in a contract or an audit response, check each cell against the current text. A mapping shows overlap, not equivalence. A CIS safeguard and a PCI requirement on the same topic can differ in how strict they are. And I verified the following in this session: the CSF 2.0 category names and identifiers (NIST CSWP 29), the CIS control names and the safeguard titles for Controls 1, 3, 5, 6, 7, 8, 11, 14, 15, 17 and 18 (CIS's assessment specification, which uses v8 numbering; CIS says the safeguard count is unchanged in v8.1, so confirm the numbers in the v8.1 workbook), the ISO/IEC 27002:2022 control titles listed on a third-party reference site (the standard itself is sold, not free), the SOC 2 common criteria series names, the PCI DSS 12 requirement names, the HIPAA citations on 45 CFR 164.308, 164.310 and 164.312, and 16 CFR 314.4. I could not re-read the NIST SP 800-171 Rev. 2 requirement numbers or the SOC 2 sub-criteria numbers from primary text, so those are marked as author recall.

On 800-171: NIST's page now shows Revision 2 as withdrawn on May 14, 2024 and superseded by Revision 3 (published May 2024, 17 families). Lesson 04 reports that the CMMC program rule still references Revision 2's 110 requirements, which is why the table uses Revision 2 numbers. Revision 3 renumbers the requirements, so do not mix the two sets in one evidence file.

Table A: frameworks

Table B: rules, attestations and contract standards

Notes that matter when you use the tables. HIPAA labels many implementation specifications "addressable," which means you must assess whether the safeguard is reasonable and appropriate and document the reasoning if you choose something else. It does not mean optional. The HIPAA citations above come from the current text on 45 CFR 164.308, 164.310 and 164.312. HHS proposed an update to the Security Rule on January 6, 2025; HHS's Security Rule page, last reviewed March 19, 2026, lists the proposal and does not state a final rule, and lesson 06 tracks the timing. SOC 2 does not prescribe controls. The CC and A1 numbers name criteria that a report's author must show are met, and the control that meets them is the company's choice. PCI DSS is a contract standard, not a statute (lesson 05).

Every deadline in the course, and where it comes from

Notification clocks have one canonical home in lesson 11. This index lists the clocks and other time limits that appear in the module, with the source and the lesson to check. Items marked "carried" were not re-read for this lesson and come from the lesson named. If you rely on one, open the source.

Time limit	Applies to	Source	Status in this lesson	Lesson
Notify the FTC as soon as possible and no later than 30 days after discovery, for events involving at least 500 consumers	Businesses under the Safeguards Rule	16 CFR 314.4(j)	Verified against the text	11
Annual penetration test; vulnerability assessments at least every six months, when continuous monitoring is absent	Safeguards Rule businesses	16 CFR 314.4(d)(2)	Verified	15
Dispose of customer information no later than two years after last use, with exceptions	Safeguards Rule businesses	16 CFR 314.4(c)(6)	Verified	17
Written report to the board at least annually	Safeguards Rule businesses	16 CFR 314.4(i)	Verified	13
Notice to individuals without unreasonable delay and no later than 60 calendar days after discovery	HIPAA covered entities	45 CFR 164.404(b)	Verified	11
Keep security documentation six years from creation or last effect, whichever is later	HIPAA covered entities and business associates	45 CFR 164.316(b)(2)(i)	Verified	10, 17
Notice to Idaho residents in the most expedient time possible and without unreasonable delay; agencies notify the Attorney General within 24 hours	Commercial entities (first clause), agencies (second clause)	Idaho Code 28-51-105	Verified; the 24-hour rule is for agencies only	07
Retain key logs at least six months	MSPs and customers, as a baseline recommendation	CISA advisory AA22-131A	Verified; guidance, not law	11
Install critical and high-risk patches within one month of release	PCI DSS entities	PCI DSS 4.0.1, 6.3.3	Verified through a third-party summary of the standard	05, 15
Keep audit logs 12 months, three months immediately available	PCI DSS entities	PCI DSS 4.0.1, 10.5.1	Unverified here; author recall	05
CMMC phase dates in the rule: Phase 2 November 10, 2026; Phase 3 November 10, 2027; Phase 4 November 10, 2028. Law-firm reports say DoD suspended Phase 2 by memo on July 13, 2026, leaving Phase 1 self-assessments in place, so the November 10, 2026 date should not be treated as binding	Defense contractors and subcontractors	32 CFR 170.3(e) and the DFARS rule; suspension from law-firm reports	Carried from lessons 04 and 16. The DoD memo itself was not retrieved: reported, not confirmed. Read each solicitation	04, 16
Four business days after deciding an incident is material	Public companies	SEC Form 8-K Item 1.05	Carried	11, 13
72 hours to the supervisory authority where feasible	Organizations in GDPR scope	GDPR Article 33	Carried	08, 11
72 hours for covered incidents, 24 hours for ransom payments	Critical infrastructure entities, once the final rule takes effect	CIRCIA	Not in force as far as lessons 11 and 13 report; not re-checked here	11, 13
45 days plus one 45-day extension to answer a California consumer request	Businesses under the CCPA	Civil Code 1798.130	Carried	13
As soon as practicable, no later than 30 days after becoming aware (Regulation S-P amendments); compliance dates December 3, 2025 for larger entities and June 3, 2026 for smaller	Broker-dealers, investment companies, registered advisers, transfer agents	SEC Regulation S-P	Carried	11
72 hours after determining a cybersecurity incident occurred; 24 hours after an extortion payment	Entities licensed under New York financial services, banking or insurance law	23 NYCRR 500.17	Carried	11
30 days to notify residents: Colorado, Florida and California; New York within 30 days of discovery; Texas no later than 60 days; Idaho with no fixed day count	Businesses holding residents' personal information	State breach statutes in the lesson 11 table	Carried; Idaho verified above	07, 11
3 calendar days to the acquirer for a suspected card data compromise (Visa, via the acquirer)	Merchants and service providers under card brand rules	Card brand rules	Carried	11
FLSA payroll 3 years; time cards 2 years; EEOC personnel records 1 year; I-9 the later of 3 years after hire or 1 year after employment ends; OSHA 300 log 5 years; FMLA 3 years; ERISA 6 years; OSHA medical records employment plus 30 years	Employers	29 CFR 516.5, 516.6, 1602.14; 8 CFR 274a.2; 29 CFR 1904.33, 825.500, 1910.1020; 29 U.S.C. 1027	Carried from lesson 17, which read each rule	17
Hold notices: written acknowledgment within 2 business days and a reminder every 90 days (the lesson's suggested practice, not a legal period)	Any business issuing a legal hold	Lesson 17 checklist; Federal Rule of Civil Procedure 37(e) sets no day count	Practice, not law	17
Children's data: written retention policy and no indefinite retention; COPPA Rule amendments compliance date April 22, 2026	Operators of online services directed to children	16 CFR 312.10; 90 FR 16918	Carried from lesson 17, which read the Federal Register page	06, 17
Connecticut employee monitoring notice rules replaced October 1, 2026 (Public Act 26-73)	Employers monitoring Connecticut staff	C.G.S. 31-48d as replaced	Carried from lesson 17, which read the act text	17
Illinois biometric data: destroy when the purpose is met or within 3 years of the person's last interaction, whichever is first	Private entities holding biometric identifiers	740 ILCS 14/15(a)	Carried from lesson 17	17

Glossary of the module's terms

Terms are defined where they first appear. This list collects 160 of them in one place, including every term in the terms boxes of lessons 1 to 17, with the lesson to read for context. Lessons 14 to 17 are the identity, vulnerabilities and patching, government contracts and sectors, and records lessons.

Term	Plain meaning	Lesson
Acceptable use policy	The rules for how staff may use company systems and data	10
Access review	A scheduled check that each person's access still matches the job	14
Acquirer	The bank or processor that holds your merchant account and answers to the card brands for your compliance. It is the party that usually sends you the PCI notices and fees.	05
Addressable (HIPAA)	A safeguard you must assess and either apply or replace with a documented equivalent	06
Adequacy decision	A formal finding by the European Commission that a country or framework gives personal data protection essentially equivalent to the EU's, so data can move there without extra safeguards.	08
Affirming Official	The senior person in a company who signs the annual statement that it continues to meet its CMMC level. The signature is entered in SPRS.	16
AI inventory	A maintained list of every AI tool and AI-enabled feature in use, with owner, purpose, data types, vendor terms and risk tier.	13
Annual affirmation	A yearly signed statement by a senior official that required controls are in place	16
Asset inventory	A current list of devices, software, accounts and data stores	03
ASV scan	A vulnerability scan of internet-facing systems run by an Approved Scanning Vendor, required quarterly for many merchants.	05
Attack surface	Everything of yours an attacker can reach from outside	15
ATT&CK	MITRE ATT&CK: a public catalog of attacker tactics and techniques used to describe and plan against attacks.	02
Attestation	An independent auditor's written opinion about controls, such as a SOC 2 report	04
Automated decision-making technology (ADMT)	Software that makes or materially influences a decision about a person, such as hiring, lending, insurance or housing, and is the focus of the newer state AI and privacy rules.	13
Backup, immutable	A backup copy that cannot be changed or deleted for a set time, even by an administrator	12
Biometric identifier	A measurement of a body feature used to identify a person, such as a fingerprint, face geometry or voiceprint.	17
Board dashboard	A one-page report of a few measured indicators, with trend, target and owner, that lets a board see program health without technical detail.	13
Board report	A written account of program status for directors or owners	13, 18
Breach notification	The duty to tell people or regulators after certain data exposures	11
Break-glass account	An emergency administrator account held offline for use when normal access fails	14, 18
Business associate	A vendor that handles protected health information for a covered entity	06, 09
Business email compromise	Fraud that uses a taken-over or faked email account to redirect money or data	10
Business impact analysis	A study of what each business function loses per hour of outage	12
C3PAO	A third-party assessor accredited to assess CMMC Level 2	04, 16
CDE	Cardholder data environment: the people, processes and systems that store, process or transmit card data, plus anything connected enough to affect their security.	05
Certification	A formal credential from an accredited body, such as ISO/IEC 27001	04
Chain of custody	A written record of who held a piece of evidence, when, and what was done to it, so that the evidence can be trusted later.	11
Chargeback	A reversal of a card payment forced by the cardholder's bank, which takes back the sale amount from the merchant and often adds a fee.	05
CIPA	The California Invasion of Privacy Act, a state criminal and civil statute on wiretapping, eavesdropping and pen registers that plaintiffs' lawyers have used against website tracking tools.	08
CIS Controls	18 prioritized security controls with 153 safeguards from the Center for Internet Security	04
CMMC	Cybersecurity Maturity Model Certification, the Defense Department's supplier program	04, 16
Compliance	Meeting the specific requirements of a law, contract or standard, and being able to prove it with records.	01
Conditional access	Rules that allow or block a sign-in based on user, device, location and risk	14
Controlled Unclassified Information	Sensitive government information that is not classified but must be protected	04, 16
Controller and processor	In most state privacy laws, the controller decides why and how personal data is used. A processor handles it on the controller's behalf under a contract.	07
Covered defense information	Unclassified controlled technical information or other CUI-registry information that is marked or identified in a DoD contract, or that the contractor creates or receives in support of it. DFARS 252.204-7012 protects it.	16
Covered entity	A health plan, clearinghouse or provider that sends health data electronically	06
Crosswalk	A table mapping one control to several standards	18
CUEC	Complementary user entity controls: the controls a SOC 2 report says the customer must run on its own side, such as removing departed employees' access, for the vendor's controls to work as described.	09
Cure period	A set number of days after an Attorney General notice during which a business can fix an alleged violation and avoid a lawsuit. Many state privacy laws have one, and some expire on a set date.	07
Custodian	A person or system that holds records covered by a hold, such as a manager's mailbox or a shared drive.	17
CVE	Common Vulnerabilities and Exposures: the public ID number, such as CVE-2021-44228, given to one specific known flaw in software or hardware.	15
CVSS	Common Vulnerability Scoring System: a 0 to 10 severity score for a flaw. It measures how bad a flaw could be, not whether anyone is using it against you.	15
Cyber insurance	Coverage for defined costs of a cyber incident	12, 18
Data broker	A business that collects and sells personal data about people it has no direct relationship with. Several states require brokers to register, and California runs a single deletion platform for them.	07
Data classification	A small set of labels, such as Public, Internal, Confidential and Restricted, that tell staff how to store, share and dispose of each kind of information.	03
Data map	A record of what sensitive data a business holds, where it is kept, how it moves between people, systems and vendors, and how it is destroyed. Also called a data flow map or data inventory.	03
Data minimization	Collecting and keeping only the data you need	13
Data Privacy Framework (DPF)	A US self-certification program run by the Department of Commerce. A US company that certifies can receive EU personal data under the Commission's 2023 adequacy decision. The UK Extension and the Swiss-US framework work the same way for those countries.	08
Data processing agreement	A contract setting how a vendor may handle your personal data	09
Deemed export	Releasing controlled technology or technical data to a foreign person inside the United States, which export control rules treat as an export to that person's home country.	16
Deepfake	Audio, video or images created or altered by AI to make a person appear to say or do something they did not.	13
Defense in depth	Stacking controls so one failure does not expose everything	02
Defensible deletion	Disposing of records on a written schedule, with a documented process and a log, so the business can show the deletion was routine and not an attempt to hide evidence.	17
DMARC	An email setting that tells receivers how to treat mail that fails sender checks	15
Edge device	A firewall, VPN gateway, router or similar appliance that sits between your network and the internet. Attackers target them because they are reachable and often lightly monitored.	15
EDR	Endpoint detection and response: software on devices that spots and contains attacks	02, 11
Electronically stored information (ESI)	Email, chat, documents, databases, logs, photos and any other data kept in electronic form that could be requested in a dispute.	17
EPSS	Exploit Prediction Scoring System: a daily score from 0 to 1 that estimates the chance a CVE will be exploited in the wild in the next 30 days.	15
Establishment	A stable arrangement in the EU, such as an office, branch or employees working there, whose activities are connected to the processing. Under GDPR Article 3(1) it brings the processing in scope wherever the data is handled.	08
Federal Contract Information	Non-public information provided by or generated for the government under a contract	16
Flow-down clause	A contract clause that a prime contractor must pass to its subcontractors, so the same duty follows the data down the chain.	16
Framework	A voluntary structure for organizing a security program, such as NIST CSF	04
GLBA	Gramm-Leach-Bliley Act, the basis for the FTC Safeguards Rule	06
Global Privacy Control	A browser signal that says a visitor opts out of sale or sharing of data	18
HIPAA	Health Insurance Portability and Accountability Act and its privacy, security and breach rules	06
Identity provider	The service that signs people in and issues their access	14
Implementation Groups	CIS tiers (IG1, IG2, IG3) that sort safeguards by organization size and risk	04
Incident response plan	The written steps, roles and contacts for handling a security event	11
Information security	Protecting the confidentiality, integrity and availability of information and the systems that hold it.	01
Information security management system	The management system that ISO/IEC 27001 requires and certifies	04
Inherent and residual risk	Inherent risk is the exposure before controls. Residual risk is what remains after the controls and other responses are in place.	03
Insider risk	Harm from people with legitimate access, careless or deliberate	10
Joiner, mover, leaver	The three moments when a person's access must change: when they start, when their job changes, and when they go.	14
Just-in-time training	A short lesson delivered at the moment of a risky action or mistake, rather than once a year in a long session.	10
KEV catalog	CISA's Known Exploited Vulnerabilities list: flaws with a CVE ID, reliable evidence of active exploitation, and a clear fix. The best free priority list for patching.	15
Known exploited vulnerability	A flaw that CISA's catalog lists as actively used by attackers (catalog page not re-read this session)	15
Lagging indicator	A measure of outcomes after the fact	18
Leading indicator	A measure of present actions that predicts later results	18
Least privilege	Giving each person only the access the job needs	02, 10
Legal hold	A suspension of deletion for records tied to a dispute or inquiry	17
Likelihood and impact	The two scores multiplied to rank a risk	03
Managed detection and response	A service that watches alerts day and night and acts on them	11, 18
Managed security service provider	A provider that runs security tools and monitoring	18
Managed service provider	A provider that runs your IT for a recurring fee	18
Material incident	For SEC registrants, a cybersecurity incident that a reasonable investor would consider important. Determining materiality starts the four business day clock for Form 8-K Item 1.05.	06
Media sanitization	Making data on storage media infeasible to recover, by clearing, purging or destroying the media, as described in NIST SP 800-88.	17
MFA	Multi-factor authentication: proving who you are with two or more things, such as a password plus a code, app prompt or hardware key.	02
Mobile application management (MAM)	Software that protects company data inside specific apps on a personal device, and can remove that data without touching personal files.	14
Mobile device management (MDM)	Software that enrolls a whole phone or laptop, enforces settings such as encryption and screen lock, and can wipe the device.	14
Multi-factor authentication	Sign-in that needs two or more kinds of proof	02, 14
Near miss	An event that could have caused harm but did not	11
NIST CSF	The NIST Cybersecurity Framework 2.0, with six Functions and 22 Categories	04
Notification event	Under the FTC Safeguards Rule, acquisition of unencrypted customer information without the individual's authorization. Notice to the FTC is due within 30 days when it involves at least 500 consumers.	06, 11
Omnibus consumer privacy law	A state statute that gives residents rights over personal data in general (access, deletion, opt-out) and puts duties on businesses above a size or volume threshold, as opposed to a law about one sector or one kind of data.	07
Organizational Profile	A NIST CSF 2.0 tool that records the cybersecurity outcomes an organization achieves today (Current Profile) and the outcomes it has chosen to reach (Target Profile).	03
Orphaned account	An enabled account whose owner has left	14, 18
P2PE	Point-to-point encryption: encrypting card data inside the payment terminal and decrypting it only at the processor, so your network never sees clear card numbers.	05
Panel vendor	A law, forensic, notification or recovery firm pre-approved by the insurer. Using one is often a condition of coverage for response costs.	12
Passkey	A sign-in credential based on public-key cryptography that lives on a device or in a credential manager and replaces the password. It follows the FIDO/WebAuthn standard.	14
PCI DSS	The card industry's contract security standard, version 4.0.1	05
Pen register	A device or process that records dialing, routing, addressing or signaling information, not the content of a communication. California plaintiffs have argued website tracking scripts are pen registers under Penal Code 638.51.	08
Penetration test	An authorized attempt to break in, done to find weaknesses	15
Personal information	Data that identifies or can be linked to a person, defined differently by each law	07
Phishing-resistant MFA	MFA, such as hardware keys or passkeys, that cannot be handed to a fake site	14
POA&M	Plan of action and milestones: a dated list of unmet requirements and how they will be fixed. CMMC allows one only for limited Level 2 and Level 3 items and requires closeout within 180 days.	16
Policy	A short management statement of what must or must not happen, approved by leadership and applying to everyone in scope.	10
Primary regulator	In Idaho Code 28-51-104, the regulator that enforces the breach law against a given entity: a federal regulator, the Department of Finance or Department of Insurance, or the Attorney General for everyone else.	07
Prior express consent	Under the Telephone Consumer Protection Act, the permission a caller must have before using an autodialer or a prerecorded or artificial voice to call a cell phone, and the standard for text marketing.	06
Privacy	Rules and choices about what personal information a business collects, why, how long it keeps it and who gets it.	01
Private right of action	A person's right to sue directly, without waiting for a regulator. California's CCPA allows it for data breaches, Illinois BIPA for biometrics and Washington's health data law through its consumer protection act.	07
Privileged account	An account that can change systems or see everything	14
Procedure	The step-by-step instructions for doing a task the same way each time, such as how to disable a departing employee's accounts.	10
Public record (Idaho)	Under Idaho Code 74-101, any writing about the conduct or administration of the public's business that a state or local agency prepares, owns, uses or retains.	16
QSA	Qualified Security Assessor: an outside firm approved by the PCI SSC to perform on-site PCI DSS assessments and issue a Report on Compliance.	05
Qualified Individual	The person the Safeguards Rule requires to oversee the security program	06, 18
Ransomware	Malware that locks or steals data and demands payment	11, 12
Reasonable security	The legal yardstick used in many statutes and FTC cases: safeguards appropriate to the sensitivity of the data, the size of the business and the cost and availability of tools.	01
Red Flag	A pattern, practice or activity that signals possible identity theft. The FTC Red Flags Rule requires certain creditors and financial institutions to have a written program to detect and respond to red flags.	06
Representative (Article 27)	A person or firm in an EU member state, designated in writing, that a non-EU business names as the contact point for regulators and individuals when GDPR applies to it through Article 3(2).	08
Rescission	An insurer's cancellation of a policy as if it never existed, usually because of a material misstatement on the application.	12
Residual risk	The risk left after controls are applied	03
Retention (deductible)	The amount of a covered loss the insured pays before the policy pays.	12
Retention schedule	A table of how long each record type is kept and how it is destroyed	17
Risk appetite	How much risk leadership will accept to reach its goals	01
Risk assessment (data protection impact assessment)	A written review of a data use that weighs the benefits against the risks to people and records the safeguards chosen, required by some privacy laws for higher-risk uses.	13
Risk register	A living list of risks with owners, ratings and treatment dates	03
Risk tolerance	A measurable limit on risk, such as a maximum loss or outage length, that turns appetite into something you can check.	01
RPO and RTO	Recovery point objective (how much data loss) and recovery time objective (how long down)	12
RROSH	Real risk of significant harm: the Canadian PIPEDA test for when a breach of security safeguards must be reported to the Privacy Commissioner and to the people affected.	08
SAQ	Self-Assessment Questionnaire: a PCI SSC form, in several types, that smaller merchants complete instead of a full on-site audit.	05
SBOM	Software bill of materials: a list of the components inside software	09, 15
Separation of duties	Splitting a sensitive task so one person cannot finish fraud alone	10
Shadow AI	Staff use of AI tools the company has not approved	13
Shadow IT	Software or cloud services employees sign up for and use for work without IT or management approval.	09
SIEM	Security information and event management: a system that collects logs from many sources, correlates them and raises alerts. Often part of an MDR service rather than something a small firm runs.	11
Single sign-on	One sign-in that opens many applications	14
SOC 2	An attestation report on controls against AICPA's Trust Services Criteria	04
Spoliation	The loss, destruction or alteration of evidence that a party should have kept.	17
SPRS	Supplier Performance Risk System: the DoD system where contractors post NIST SP 800-171 self-assessment scores, CMMC statuses and annual affirmations.	16
Standard	A specific, measurable requirement that makes a policy testable, such as a minimum password length or a required encryption method.	10
Standard Contractual Clauses (SCCs)	Model contract terms adopted by the European Commission (Decision 2021/914) that the sender and receiver of personal data sign to make a transfer outside the EU lawful where there is no adequacy decision.	08
Statement of Applicability	The ISO 27001 document listing which controls apply and why	04
Strict liability	Liability that applies whether or not the person knew or intended the violation. OFAC applies it to sanctions violations, including ransom payments to sanctioned parties.	11
Sublimit	A lower cap inside an insurance policy for one type of loss	12
Subservice organization	A vendor that your vendor relies on to deliver part of its service, such as a cloud host. In a SOC 2 report it is either carved out of the testing or included.	09
Tabletop exercise	A talked-through rehearsal of an incident	11
Tenant	Your company's own space inside a cloud service such as Microsoft 365	18
Third-party risk	Risk that arrives through vendors and service providers	09
Three lines model	The Institute of Internal Auditors' way of dividing risk work among operating management (first line), risk and compliance functions (second line) and independent internal audit (third line), all answering to a governing body.	01
Tokenization	Swapping a card number for a stand-in value that is useless if stolen	05
Underwriting	The insurer's judging of your risk and setting of terms	12, 18
Unfair or deceptive act or practice	The standard in Section 5 of the FTC Act. A practice is unfair if it causes or is likely to cause substantial injury to consumers that they cannot reasonably avoid and that is not outweighed by benefits.	06
vCISO	A part-time security leader engaged on retainer	18
Vendor tiering	Sorting vendors by how much harm they could cause you, so the heaviest review and the strongest contract terms go to the few that matter most.	09
Vulnerability disclosure policy	A public statement telling outsiders how to report a security flaw to you and promising not to pursue good-faith reporters. Often paired with a security.txt file.	15
Vulnerability management	Finding, ranking and fixing software and configuration weaknesses	15
Waiting period	The hours of outage before business interruption cover starts	12
WISP	Written information security program: the documented set of administrative, technical and physical safeguards that Massachusetts regulation 201 CMR 17.00 requires of anyone who holds a Massachusetts resident's personal information.	07
Zero trust	A design that checks every request instead of trusting the network	02, 14

Questions and answers

Do we need both an MSP and an MDR service?

Most firms of 50 or more people benefit from both, or from an MSP and a separate detection service. An MSP's daytime ticket queue is built for broken laptops. A detection service is built to read alerts at 3 a.m. and cut off a compromised machine. If one vendor sells both, ask who sits behind the night alerts and what they may do without calling you.

When does a company need a vCISO?

When someone has to own the program and nobody inside has the time or the skill. Signs: customers send security questionnaires the IT manager cannot answer, the insurer asks about governance, the Safeguards Rule or HIPAA requires a named responsible person, or the board wants quarterly reports. A vCISO is a leader on retainer. It is not a replacement for the people who run the tools.

Is it a conflict if our MSP also writes our security policies?

It is a risk. The provider then grades its own work. It is fine for the MSP to draft technical standards. Have someone else, an internal owner or a vCISO, approve them and check the evidence. If that is not affordable, at minimum have an executive read the monthly report against raw counts from the consoles.

How much should we spend on security?

There is no sourced standard for companies of 10 to 500 people. Use the three tiers, tie each line to a risk in your register, and compare with the 13.2 percent of IT budget reported by IANS and Artico for firms with CISOs as a sanity check only. Revisit after each incident and each renewal.

Can the same evidence serve different standards?

Often, yes. A dated MFA coverage export answers questions under several frameworks at once, as the crosswalk shows. Check that the evidence meets the stricter wording. HIPAA 164.312(d), for instance, does not name MFA, while the Safeguards Rule at 314.4(c)(5) does.

What if an application answer is only partly true?

Say so on the form. Describe the coverage, the plan and the date, attach evidence, and tell the broker. A partial answer with a record is easier to defend than a rounded one. Lesson 12 explains why the application becomes the first thing a claim reviewer reads.

How many metrics should the board see?

Six to eight, with trends. The 15 in the catalog are the manager's working set. The board needs the ones that drive a decision this quarter, plus one page of facts on incidents and risk movement.

What belongs in the evidence library?

One dated item per control area in the crosswalk: exports, screenshots, signed policies, test records, contracts, reports. Name each file with the control ID and the date. Replace items on a calendar, quarterly for fast-moving ones such as MFA and patching, annually for policies.

Hard questions

"Our MSP says it holds the global administrator account because that is how it keeps us safe. Why change that?"

Because safety and control are different things. A provider that holds the only keys can lock you out through a dispute, a mistake or its own compromise. CISA's advisory names exactly that exposure when it tells customers to restrict provider access, require MFA on provider accounts and disable accounts at contract end. Keep two emergency accounts of your own, held offline, and let the provider work through named delegated accounts. A good provider will agree. One that refuses has told you how it values your exit.

"A fractional leader at a few thousand dollars a month cannot know our business. Isn't that just a paper exercise?"

It can be, if the engagement is only policy templates. The test is output. In a quarter a working vCISO should leave behind a risk register you recognize, owner names on the high risks, a vendor tier list, a tabletop with actions and a board page. If after a quarter you have documents but no changed behavior, change the scope or change the vCISO. The same logic applies to any hire.

"Insurers just want a checklist. Why spend money on evidence when we can answer yes and move on?"

Because the answers are statements of fact that can be tested after a loss. Lesson 12 describes a dispute in which a carrier alleged that MFA answers were untrue. A dated export costs minutes to produce. A denied or reduced claim costs the loss. The Pinewood example shows a $1,900 fix against a $380,000 exposure.

"The crosswalk lets us claim compliance with eight standards from one report. Isn't that overclaiming?"

It is, if you say it that way. A crosswalk shows that one control produces evidence relevant to several standards. It does not show that you meet any of them. PCI requires an assessor or a signed attestation, SOC 2 needs an auditor, ISO 27001 needs an accredited certification body, and HIPAA needs a documented risk analysis. Describe the crosswalk internally as a way to reduce repeated work and say externally only what each standard actually certifies.

"A budget table with invented numbers is no help. Why not give us a figure?"

Because no honest figure exists for every company. The sourced anchors in this lesson are a 2024 survey percentage from firms with CISOs and list prices from lesson 02. The rest are planning estimates labeled as such. The tier method gives you a way to turn your own quotes into a number the board can approve, and to record what you chose not to fund.

Pictures, Numbers and Infographics

Verified figures used in this lesson

Lesson 13 holds the figures on breach cost, fraud losses and notification clocks. This table lists the new numbers from this lesson, with the source and how firmly it is established.

Figure	Value	Source and date	Note
MSP advisory AA22-131A	Issued May 11, 2022 by CISA, NSA, FBI and the cyber agencies of the UK, Australia, Canada and New Zealand; baseline of at least six months of key logs	Advisory text via UK NCSC copy	Primary; CISA's own page did not load
Security share of IT budget	13.2 percent in 2024, up from 8.6 percent in 2020; 750 CISOs surveyed, 681 answered budget questions	IANS Research and Artico Search, via Cybersecurity Dive, September 2024	Secondary report of a survey; firms large enough to employ a CISO
vCISO retainers	$1,500 to $4,000 a month (1 to 50 staff); $3,000 to $7,000 (50 to 200); $5,000 to $12,000 (200 to 500); $200 to $400 an hour ad hoc	SideChannel guide	Vendor marketing; internally inconsistent
Claims frequency and severity, 2025	Frequency up 7 percent; average severity $221,000; financial fraud 30 percent of claims at $285,000 average loss	At-Bay 2026 InsurSec Report, April 22, 2026	One insurer's portfolio of more than 100,000 policy years
Ransomware in claims	Akira over 40 percent of At-Bay ransomware claims in 2025; 86 percent of Akira attacks where a SonicWall device was present	Same report	Vendor data
CISA Cyber Hygiene scanning	Free for governments and critical infrastructure; weekly vulnerability reports, monthly web application reports	CISA page	Primary; small businesses outside critical infrastructure not listed
NIST CSF 2.0	Published February 26, 2024; 6 Functions and 22 Categories (Govern 6, Identify 3, Protect 5, Detect 2, Respond 4, Recover 2)	NIST CSWP 29	Primary; count of categories is the sum of the table rows
CIS Controls	18 Controls; 153 safeguards in v8 and v8.1	CIS pages (names); lesson 04 (153)	Safeguard total not shown on the pages read in this session
ISO/IEC 27002:2022	93 controls: organizational 37, people 8, physical 14, technological 34	Lesson 04; third-party list shows 93	The standard is sold; check your licensed copy
PCI DSS	12 principal requirements in six goals; critical and high patches within one month (6.3.3)	PCI DSS 4.0.1 text; third-party summary for 6.3.3	Primary for the 12; secondary for the patch rule
SOC 2	Five categories: Security, Availability, Processing Integrity, Confidentiality, Privacy; nine common criteria series, CC1 to CC9	AICPA page; third-party list of the series	Sub-criteria numbers not re-read from AICPA's PDF
NIST SP 800-171	Rev. 3 published May 2024 with 17 families; Rev. 2 listed as withdrawn May 14, 2024	NIST pages	CMMC still pins Rev. 2 per lesson 04
NIST SP 800-55	Volumes 1 and 2 final, December 2024	NIST CSRC	Primary
Safeguards Rule clocks	30 days to FTC (500 or more consumers); disposal within two years; testing every six months; annual board report	16 CFR 314.4(j), (c)(6), (d), (i)	Primary
HIPAA	60 calendar days for breach notice; 6-year documentation retention	45 CFR 164.404(b); 164.316(b)(2)(i)	Primary

Picture 1: one evidence item, eight standards

Picture 2: a 12-month roadmap by workstream

Picture 3: a security metrics dashboard with sample numbers