Cybersecurity Fundamentals
Reviewed by the Fully Compliance editorial team. Last updated March 2026. Short answer: Phishing exploits human psychology, not technical vulnerabilities, and remains the most common entry vector for cyberattacks. The Verizon 2024 DBIR found that 68% of breaches involved a human element. Defense requires layered controls combining email authentication, filtering,
Cybersecurity Fundamentals
Reviewed by the Fully Compliance editorial team. Last updated March 2026. Short answer: Business email compromise is fraud that uses email to trick employees into sending wire transfers, changing vendor payment details, or disclosing sensitive data. BEC caused $2.9 billion in reported losses in 2023 according to the FBI
Cybersecurity Fundamentals
Reviewed by the Fully Compliance editorial team. Last updated March 2026. Short answer: Ransomware encrypts your files and demands payment for the decryption key, often while also threatening to publish stolen data. The FBI IC3 reported $59.6 million in adjusted ransomware losses in 2023, and the Ponemon Institute found
Cybersecurity Fundamentals
Reviewed by the Fully Compliance editorial team. Last updated March 2026. Short answer: Cyberattacks follow predictable patterns driven by economics, not random sophistication. Ransomware causes the most financial damage, phishing is the most common entry vector, and most attacks succeed by exploiting basic security gaps. The FBI IC3 reported $12.
Compliance Frameworks
Reviewed by James Corbin, CISSP, FedRAMP 3PAO Assessor FedRAMP is the federal government's mandatory authorization program for cloud services. No authorization means no government sales — period. Authorization requires implementing NIST 800-53 controls, passing an independent third-party assessment, and PMO approval. The process takes 12-24 months and costs $500K
Compliance Frameworks
Reviewed by James Corbin, CISSP, CJIS Security Policy Specialist CJIS is the FBI's security standard for protecting criminal justice information — and it is non-negotiable. Every person and system accessing the CJIS network must meet prescriptive requirements for data classification, multifactor authentication, encryption at rest and in transit, network
Compliance Frameworks
Reviewed by Thomas Reinhardt, CISA, CRISC, Financial Services Compliance Specialist GLBA is federal law requiring every financial institution — banks, insurance companies, credit unions, lenders — to protect customer information through the Safeguards Rule, Privacy Rule, and disposal requirements. The 2023 FTC Safeguards Rule update made requirements significantly stricter, mandating encryption, MFA,
Compliance Frameworks
Reviewed by Sarah Mitchell, Ed.D., CIPP/US FERPA is education's foundational privacy law, granting students and parents rights to access and correct educational records while restricting disclosure to third parties without consent. It applies to virtually every school receiving federal funding. Unlike HIPAA, FERPA prescribes no specific
Compliance Frameworks
Reviewed by Danielle Vargas, CIPP/US, CIPM All 50 states and DC have data breach notification laws requiring you to notify affected individuals, and often regulators, within specific timeframes after discovering a breach. The laws differ in timing, content, recipient requirements, and penalties — meaning a multi-state breach requires managing multiple
Compliance Frameworks
Reviewed by Danielle Vargas, CIPP/US, CIPM At least twelve US states have enacted comprehensive privacy laws, and that number will reach twenty within two to three years. The laws share a common pattern — consumer rights to access, delete, correct, and opt out — but vary in scope, definitions, timelines, and
Compliance Frameworks
Reviewed by Danielle Vargas, CIPP/US, CIPM CPRA replaced key parts of the original CCPA in 2023, expanding consumer rights, broadening the definition of personal information, and creating a dedicated enforcement agency. Any for-profit business collecting data from California residents is likely in scope. Penalties run $2,500-$7,500
Compliance Frameworks
Reviewed by Danielle Vargas, CIPP/US, CIPP/E, CIPM GDPR applies to any US company processing personal data of EU residents — regardless of where you're located, incorporated, or host servers. Fines reach 4% of global annual revenue or 20 million euros, whichever is higher. Enforcement is active and