Learning Tools
Education · Advocacy · Activism

Education, Advocacy and Activism

Free training, tools and resources for journalists, advocates, activists and campaigns, with a focus on Idaho transparency, civic data and liberty.

A lock means the tool needs an account. Request one here.

🔒 Training: Privacy and Security

11 learning modules. This page updates itself when items move between sections.

Protecting yourself, your sources and your business: the privacy guide from five-minute settings to counter-surveillance, surveillance technology and the law, home computer and phone security for homeowners and seniors, small business data security, and digital safety for writers.

In this section
  1. Guarding Your Privacy Online and IRL Learning Module
  2. Surveillance Technology and Privacy Learning Module
  3. Securing Your Home Computer, Phone and Money: A Plain Guide for Homeowners and Seniors Learning Module
  4. Securing Your Small Business Data and Systems: A Guide for Owners and Office Staff Learning Module
  5. Digital Safety for Writers Learning Module
  6. Guarding Your Privacy Online and IRL: Counter-Surveillance and Privacy Tools from the Mundane to Hyper-Vigilance Learning Module
  7. Privacy and Data Security Laws Learning Module
  8. Privacy and Security for Small and Medium Businesses: A Management Guide to Layered Defense, Privacy Laws and Security Standards Learning Module
  9. Healthcare Cybersecurity and HIPAA Learning Module
  10. Cybersecurity for Legal, Accounting and Professional Services Learning Module
  11. Cybersecurity for Manufacturing and Industrial Control Systems Learning Module

🛡️ Guarding Your Privacy Online and IRL Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

A free, practical guide to protecting your privacy online and in real life, from five-minute settings to hyper-vigilance: counter-surveillance and privacy tools. 9 lessons.

What is included: 8 lessons and pages
  1. The Privacy Ladder: Who Is Watching and How Far to Go 20 min
    Who actually collects data about ordinary people, how that data moves from your phone to ad auctions, brokers, government buyers and stalkers, and how to pick the level of protection that fits your life.
  2. Your Phone: How It Leaks and How to Close It 22 min
    How your phone knows where you are, how the advertising ID and app SDKs turn that into a product brokers sell, what police tools can pull from a phone, and the iPhone and Android settings that cut the leaks, up to Lockdown Mode, Advanced Protection and hardened phones.
  3. Browsing, Search and Email: How You Are Followed and How to Cut It 22 min
    How cookies, embedded trackers, fingerprinting, DNS lookups and email pixels follow you, what your internet provider and even privacy tools can see, what a VPN and Tor actually change, and the settings and tools that cut each leak.
  4. Messaging and Calls 22 min
    Who can read your texts, who can steal your phone number, what your call records reveal even when the words are encrypted, and how to cut each risk down, from free settings to a separate phone.
  5. Data Brokers, Credit and Identity 22 min
    How data brokers and people-search sites build a file on you, how breaches feed identity theft and synthetic identities, and what actually shrinks the risk: credit freezes, opt-outs, address control and, for survivors, Idaho's Address Confidentiality Program.
  6. Out in Public: Plate Readers, Face Scans, Events and Protests 22 min
    How plate reader networks store and share your drives, how store and venue face recognition goes wrong, how a geofence warrant sweeps up every phone near a scene, what changes on protest day, and what each defense does and costs, with the legal lines on plate covers, jammers, camera damage and masks.
  7. Vehicles, Travel and Trackers 22 min
    What a connected car records and who has bought it, how rental cars, tolls and loyalty programs build a travel trail, how hidden trackers are used for stalking and how phones now warn about them, and what CBP can do with your devices at the border, with what each defense does and costs.
  8. Hyper-Vigilance: When It Is Worth It and How to Do It Right 24 min
    Who is actually at risk of being tracked and by whom, how stalkerware and shared accounts work, how separate identities get linked back, what being followed looks like, and how Levels 4 and 5 answer each threat, with safety help for survivors and the full ladder with your own plan.
trainingprivacysurveillancecounter-surveillancesecurityalprphonebrowser

Quote Verification Last Ran (October 27, 2026)

Open Guarding Your Privacy Online and IRL ↗

📡 Surveillance Technology and Privacy Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

Learn how plate readers, face recognition, drones, phone tools and data brokers work, what the Fourth Amendment and state laws say about them, and how to judge a local surveillance program fairly using contracts, policies and audit logs. A module of Issues and Advocacy Training, 9 lessons.

What is included: 9 lessons and pages
  1. The Fourth Amendment in Eight Cases 16 min
    Learn the tests courts use to decide when watching, tracking or collecting data counts as a search, from Katz in 1967 to the 2026 geofence decision.
  2. How License Plate Readers Work 15 min
    Follow a single plate read from the camera to the hotlist check, the database, and the sharing network, and learn the numbers that matter.
  3. Plate Readers: Results, Misuse, Courts and Pushback 24 min
    Weigh the evidence on what plate readers do, the growing record of misuse including an Idaho sheriff's case, the court rulings turning against mass collection, and the cities and citizens pushing back.
  4. Facial Recognition: Accuracy, Arrests and Rules 16 min
    Learn how face recognition matches work, what NIST testing found about accuracy and demographic gaps, what went wrong in wrongful arrests, and how states regulate police use.
  5. Drones, Camera Networks and Real-Time Crime Centers 15 min
    See how police drones, public and private camera networks, and real-time crime centers fit together, and what federal and Idaho law says about drones.
  6. Phones: Cell-Site Simulators, Location Requests and Extraction Tools 16 min
    Learn how police locate phones, request location records from companies, and copy data off seized phones, and what legal process each step needs.
  7. Data Brokers and Police Purchases 15 min
    Learn how app location data reaches data brokers, why buying it can sidestep warrant rules, where federal legislation stands, and what the FTC has done.
  8. Private Surveillance: Doorbells, Partnerships and the Workplace 14 min
    Learn how doorbell camera companies route footage to police, what the FTC found about Ring, and what rules cover employers who monitor workers.
  9. Records to Request and How to Judge a Surveillance Program Fairly 18 min
    Know the records that exist for any surveillance program, read contracts and audit logs for the facts that matter, and hold police and privacy advocates to the same standard of proof.
moduleissuesprivacy and security

Quote Verification Last Ran (October 27, 2026)

Open Surveillance Technology and Privacy ↗

🏠 Securing Your Home Computer, Phone and Money: A Plain Guide for Homeowners and Seniors Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

Plain-language steps to protect your computer, phone, accounts and money at home and on the road: updates, passwords, two-step sign-in, Wi-Fi, email and browsing privacy, the common scams explained one by one, what to do in order when something goes wrong, and how to travel with your devices safely. A module of Issues and Advocacy Training, 11 lessons.

What is included: 11 lessons and pages
  1. Emergency cheat sheet: print and fill in your numbers
  2. What You Are Protecting, and Who Is After It 18 min
    What is really at stake on your home computer, phone and bank accounts, how harm usually happens, the layered idea in home terms, and the five habits that stop most of it.
  3. Updates, Antivirus and the Settings That Matter 22 min
    Turn on automatic updates, understand what the built-in antivirus does, deal with Windows 10 end of support, tidy your browser, use a standard account, lock your screen and scramble your disk.
  4. Passwords, Two-Step Sign-In and Passkeys 24 min
    How to make passwords that hold up, use a password manager (including free built-in ones), turn on two-step sign-in, try passkeys, keep recovery codes, and protect the accounts that matter first.
  5. Your Wi-Fi Router, Smart Devices and Public Wi-Fi 24 min
    Lock down the box that connects your whole house to the internet, sort out smart TVs, cameras, doorbells and printers, and learn what a firewall and a VPN really do.
  6. Email, Browsing and Online Privacy 22 min
    Why your email account is the master key to everything else, what secure email really means, and how to tame spam, trackers, ads, people-search sites and social media settings.
  7. Phones, Tablets and Apps 24 min
    How to lock your phone, guard your phone number against SIM swaps, control what apps can see, find a lost phone, spot text scams, and wipe an old phone properly.
  8. Common Scams Explained, One by One 38 min
    Sixteen scams that target homeowners and seniors, each with how it works, the tell, and what to do, plus a master warning-signs table and one simple rule: stop, hang up, and call back on a number you know.
  9. Money, Credit and Identity 26 min
    How to lock your credit file for free, check your credit reports, protect your tax and Social Security records, set up bank alerts, know which payments can be reversed, and keep thieves away from your mail and from a loved one's identity after a death.
  10. When Things Go Wrong: The First Hour, Day and Week 22 min
    What to do, in order, if you clicked a bad link, gave out a password or code, let a stranger onto your computer, sent money, gave your Social Security number, lost your phone or got hit by ransomware, and who to report it to.
  11. Travel and Public Places 22 min
    How to get your phone, laptop, cards and home ready before a trip, stay safe at airports, hotels, ATMs and in rental cars, handle a border device search in general terms, and clean up when you get home.
moduleissuesprivacy and security

Quote Verification Last Ran (October 27, 2026)

Open Securing Your Home Computer, Phone and Money: A Plain Guide for Homeowners and Seniors ↗

🗄️ Securing Your Small Business Data and Systems: A Guide for Owners and Office Staff Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

How a small business protects its local and cloud data in layers: accounts and two-step sign-in, computers and backups, SaaS and shared files, secure email and browsing defined, phones and mobile devices, the scams that target businesses, and an incident playbook for when something goes wrong. A module of Issues and Advocacy Training, 11 lessons.

What is included: 12 lessons and pages
  1. Emergency cheat sheet: print and fill in your numbers
  2. Your Data and Layered Defense 22 min
    Inventory what data a small business holds and where it lives, see why small firms get targeted, and learn the layered approach (prevent, detect, respond, recover) that the rest of the course builds.
  3. Accounts, Passwords and Two-Step Sign-In 24 min
    Give every person their own login, use a business password manager, turn on two-step sign-in in the right strength, separate admin accounts, and run onboarding and offboarding checklists so access ends when a job does.
  4. Computers, Local Data and Backups 26 min
    Inventory the machines, keep them updated and encrypted, tame file servers, USB drives and printers, dispose of old gear safely, and build a tested backup with an offline copy that survives ransomware.
  5. Cloud, SaaS and Shared Files 28 min
    Understand what the cloud and SaaS really are, who is responsible for what, how to set sharing, guest access and app connections in Microsoft 365 and Google Workspace, how to vet vendors, and how to back up and exit from the services your business runs on.
  6. Secure Email and Secure Browsing 22 min
    What secure email and secure browsing actually mean, how SPF, DKIM and DMARC stop people from faking your domain, and the mailbox and browser settings an office can fix in an afternoon.
  7. Network, Wi-Fi and Remote Work 22 min
    Lock down the router and Wi-Fi, split guests and devices onto their own networks, handle remote access and home workers without opening the front door, and cover the physical basics: locks, visitors and a clean desk.
  8. Phones, Tablets and Mobile Devices 22 min
    Company phones versus personal phones, the screen lock and update basics, what mobile device management is and the cheap versions you may already own, plus lost-phone steps, SIM-swap protection, text scams and leaving employees.
  9. Scams Aimed at Businesses 45 min
    The fraud that actually costs small firms money: fake vendor bank changes, boss and payroll requests, tech support and domain-renewal invoices, QR codes, ransomware extortion, voice clones and fake job applicants. Each scam gets how it works, the tell and the control, plus a callback procedure, a dual-approval rule and a playbook for the person at the front desk.
  10. Payment Cards, Customer Data and Records 24 min
    How to take cards without storing them, what PCI DSS asks of a small merchant, how to keep customer and employee records lean, and how long to keep and how to destroy what you hold.
  11. When Something Goes Wrong 26 min
    A plain incident plan for a small shop: the signs of trouble, what to do in the first hour, day and week, who to call, what to keep, the facts on ransomware payments and wire recalls, Idaho breach notice basics and a one-page incident card.
  12. Policies, Training and a 90-Day Plan 30 min
    A two-page security policy a 10-person shop can actually follow, 15-minute monthly training, kind phishing drills, cyber insurance basics, a vendor checklist, a 30/60/90-day plan, a rough budget table and a page of verified numbers and pictures.
moduleissuesprivacy and security

Quote Verification Last Ran (October 27, 2026)

Open Securing Your Small Business Data and Systems: A Guide for Owners and Office Staff ↗

🔐 Digital Safety for Writers Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

Build a plain-language security plan, then lock down your accounts, devices, sources, files and website so one bad day does not end your reporting. Includes what to do, in order, if you get hacked or harassed. A module of Journalism Training, 9 lessons.

What is included: 9 lessons and pages
  1. Threat Modeling in Plain Terms 14 min
    Write a one-page security plan by listing what you have, who might want it, how bad losing it would be and how much effort protection is worth.
  2. Passwords, Password Managers and Passkeys 15 min
    Stop reusing passwords, set up a password manager with one strong passphrase, and start replacing passwords with passkeys where sites allow it.
  3. Two-Factor Authentication and SIM-Swap Protection 15 min
    Rank the kinds of two-factor sign-in from weakest to strongest, move your key accounts off text-message codes, and lock your phone number at your carrier.
  4. Phishing and Social Engineering 16 min
    Spot fake messages and pretext calls aimed at writers, read a link's real domain, and verify any request through a channel you already trust.
  5. Device Security: Updates, Locks, Encryption and Travel 16 min
    Keep phones and laptops patched, locked and encrypted, plan for a lost or stolen device before it happens, and pack a lighter digital load when you travel.
  6. Talking to Sources Safely 17 min
    Protect the people who trust you: set up Signal properly, understand what email and metadata reveal, know what SecureDrop is for, and decide what never goes in writing.
  7. Protecting Files: Backups, Encryption and Ransomware 15 min
    Set up a 3-2-1 backup, decide what belongs in the cloud and what stays local, encrypt the copies, and make sure ransomware cannot take the backups with it.
  8. Doxxing and Online Harassment 17 min
    Shrink the personal information about you that is for sale online, lock down your social accounts, and know how to document, report and get support if harassment starts.
  9. Securing Your Site and Recovering From a Hack 18 min
    Lock your domain, hosting, CMS and newsletter accounts, then follow a step-by-step recovery plan if any account or your website is taken over.
moduletrainingprivacy and security

Quote Verification Last Ran (October 27, 2026)

Open Digital Safety for Writers ↗

📘 Guarding Your Privacy Online and IRL: Counter-Surveillance and Privacy Tools from the Mundane to Hyper-Vigilance Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

A practical guide to protecting your own privacy, online and in real life. Step-by-step settings and habits for your phone, accounts, home, car and travels, arranged from five-minute fixes anyone can make to the habits of people with real reasons to fear being tracked, with what each step costs and where the legal lines are. A module of a special edition, 9 lessons.

What is included: 8 lessons and pages
  1. The Privacy Ladder: Who Is Watching and How Far to Go 20 min
    Who actually collects data about ordinary people, how that data moves from your phone to ad auctions, brokers, government buyers and stalkers, and how to pick the level of protection that fits your life.
  2. Your Phone: How It Leaks and How to Close It 22 min
    How your phone knows where you are, how the advertising ID and app SDKs turn that into a product brokers sell, what police tools can pull from a phone, and the iPhone and Android settings that cut the leaks, up to Lockdown Mode, Advanced Protection and hardened phones.
  3. Browsing, Search and Email: How You Are Followed and How to Cut It 22 min
    How cookies, embedded trackers, fingerprinting, DNS lookups and email pixels follow you, what your internet provider and even privacy tools can see, what a VPN and Tor actually change, and the settings and tools that cut each leak.
  4. Messaging and Calls 22 min
    Who can read your texts, who can steal your phone number, what your call records reveal even when the words are encrypted, and how to cut each risk down, from free settings to a separate phone.
  5. Data Brokers, Credit and Identity 22 min
    How data brokers and people-search sites build a file on you, how breaches feed identity theft and synthetic identities, and what actually shrinks the risk: credit freezes, opt-outs, address control and, for survivors, Idaho's Address Confidentiality Program.
  6. Out in Public: Plate Readers, Face Scans, Events and Protests 22 min
    How plate reader networks store and share your drives, how store and venue face recognition goes wrong, how a geofence warrant sweeps up every phone near a scene, what changes on protest day, and what each defense does and costs, with the legal lines on plate covers, jammers, camera damage and masks.
  7. Vehicles, Travel and Trackers 22 min
    What a connected car records and who has bought it, how rental cars, tolls and loyalty programs build a travel trail, how hidden trackers are used for stalking and how phones now warn about them, and what CBP can do with your devices at the border, with what each defense does and costs.
  8. Hyper-Vigilance: When It Is Worth It and How to Do It Right 24 min
    Who is actually at risk of being tracked and by whom, how stalkerware and shared accounts work, how separate identities get linked back, what being followed looks like, and how Levels 4 and 5 answer each threat, with safety help for survivors and the full ladder with your own plan.
modulespecial edition: guarding your privacy

Quote Verification Last Ran (October 27, 2026)

Open Guarding Your Privacy Online and IRL: Counter-Surveillance and Privacy Tools from the Mundane to Hyper-Vigilance ↗

📘 Privacy and Data Security Laws Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

The federal and state privacy and data security laws in plain terms: what each one covers, who it binds, the rights it gives and how it is enforced, from the Privacy Act, HIPAA, GLBA, FERPA, COPPA and the wiretap laws to the state consumer privacy, biometric, health data and breach notice laws, with Idaho's statutes up close, every key term defined, real enforcement cases, and a short closing lesson on mitigation and best practices. A module of Issues and Advocacy Training, 11 lessons.

What is included: 11 lessons and pages
  1. The Terms and the Map 24 min
    How U.S. privacy law is built from sector laws, state laws, FTC Section 5 and the Constitution, and the exact statutory meaning of the words that decide who owes what: personal information, PII, sensitive data, PHI, NPI, education records, consumer reports, breach versus incident, encryption safe harbor, controller and processor, consent, sale, data broker, de-identified data, assessments and notice deadlines.
  2. The Privacy Act and Government Records 25 min
    How the Privacy Act of 1974 governs federal agency files: systems of records, SORNs, the 13 disclosure exceptions, routine uses, access and amendment rights, damages after Doe v. Chao and FAA v. Cooper, computer matching, privacy impact assessments, the Social Security number rule, FOIA's privacy exemptions, the 2025 and 2026 lawsuits over DOGE access to Social Security data, the Driver's Privacy Protection Act and …
  3. Health Privacy: HIPAA and Beyond 27 min
    HIPAA's Privacy, Security and Breach Notification Rules in depth: who is covered, what PHI is, minimum necessary, the patient's right of access, permitted disclosures, breach notice, the inflation-adjusted penalty tiers, state attorney general suits, OCR cases from Anthem to 2026 ransomware settlements, Change Healthcare, the vacated 2024 reproductive health rule, the stalled Security Rule update, 42 CFR Part 2, the…
  4. Money, Credit and Financial Data 24 min
    The Fair Credit Reporting Act, FACTA's Red Flags and Disposal Rules, Gramm-Leach-Bliley and Regulation P, the FTC Safeguards Rule and its 30-day breach notice, SEC Regulation S-P, New York's Part 500, the CFPB's open banking rule, and the Equifax and Capital One cases.
  5. Children and Students 24 min
    COPPA and the FTC's 2025 rule amendments, the record COPPA penalties, FERPA and the student records rights it gives parents and students, the PPRA, state student privacy laws on the California SOPIPA model, the court fights over age-appropriate design codes and age verification, and where KOSA and COPPA 2.0 stand as of October 2026.
  6. Wiretaps, Computers and Communications 25 min
    The Electronic Communications Privacy Act's three parts (the Wiretap Act, the Stored Communications Act and the Pen Register Act), one-party and all-party recording states, website tracking lawsuits under state wiretap laws, the Computer Fraud and Abuse Act after Van Buren, the Video Privacy Protection Act case now before the Supreme Court, and the TCPA and CAN-SPAM rules for calls, texts and email.
  7. The FTC and Federal Security Rules 26 min
    How the FTC turned Section 5 of the FTC Act into the country's main privacy and data security enforcer, what Wyndham, LabMD and AMG Capital did to its powers, the recent location data, facial recognition and connected car cases, and the other federal security rules: the SEC's four-business-day incident disclosure, CIRCIA's 72-hour reports, PADFA and the DOJ bulk data rule, the TikTok law, FCC carrier rules, the bank…
  8. State Consumer Privacy Laws 30 min
    California's CCPA and its privacy agency, then every state with a broad consumer privacy law as of October 2026 (23 states, 19 in effect), with citations, effective dates, thresholds, cure periods and enforcers; the Virginia model and where states depart from it; universal opt-out signals; data broker registries and California's DROP; biometric laws in Illinois, Texas, Washington and Colorado; and the state enforcem…
  9. Breach Notification Laws in All 50 States 28 min
    Every state, D.C., Puerto Rico, Guam and the U.S. Virgin Islands requires notice when personal information is breached. The parts every law shares, where they split (definitions, harm tests, encryption, deadlines, regulator and credit bureau notice, private suits), a 51-row table built from the statutes, the federal overlays, how to read a breach letter, and what to do after one arrives.
  10. Idaho Privacy Law Up Close 30 min
    Idaho has no broad consumer privacy law as of October 2026. What it has is a stack of narrower statutes: the breach law at Idaho Code 28-51-104 to 107, the student data law at 33-133, the Consumer Protection Act, the wiretap and identity theft crimes, the Genetic Testing Privacy Act, the 2024 age verification law, the 2025 license plate reader law, the 2026 social media and digital ID laws, and the bills from 2023 t…
  11. Mitigation and Best Practices 18 min
    The short closing lesson: what to do after a breach letter, how small businesses, nonprofits and campaigns can collect less, lock down accounts, encrypt, manage vendors and plan a response timed to the strictest law that applies, the frameworks to use, a one-page checklist, and the course's verified numbers in one place.
moduleissues and advocacy training

Open Privacy and Data Security Laws ↗

📘 Privacy and Security for Small and Medium Businesses: A Management Guide to Layered Defense, Privacy Laws and Security Standards Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

For owners, managers and executives of small and medium businesses: 18 lessons on building and governing a layered security and privacy program, which federal and state privacy and breach laws apply, how NIST CSF, CIS Controls, ISO 27001, SOC 2 and PCI DSS fit together, identity and device control, patching and your website, vendors, people, incidents, insurance, government contracts and sector rules, records retention and legal holds, and reporting risk to the board. A module of Issues and Advocacy Training, 18 lessons.

What is included: 18 lessons and pages
  1. Why Management Owns the Risk 22 min
    Privacy, security and compliance are three different jobs, and the law, regulators, customers and insurers all hold management, not the IT department, answerable for them. This lesson covers breach costs, the FTC Act, the reasonable security idea, director oversight, the roles every business needs and risk appetite.
  2. Layered Defense Architecture 24 min
    Defense in depth for a business of 10 to 500 people: eleven layers from governance to recovery, what each stops in an attack chain, zero trust in plain terms, maturity levels, and the minimum stack by company size with rough costs.
  3. Risk Assessment and Data Mapping: Know What You Have Before You Rank What Can Hurt It 28 min
    How a manager builds an asset inventory, classifies data, draws data flow maps, scores risks with a likelihood and impact scale, keeps a risk register, chooses to treat, transfer, accept or avoid each risk, signs off residual risk, and decides how often to repeat the work.
  4. Security Frameworks and Standards: NIST CSF, CIS, ISO 27001, SOC 2 and CMMC 24 min
    What NIST CSF 2.0, CIS Controls v8.1, ISO/IEC 27001:2022, SOC 2, NIST SP 800-171 with CMMC, HITRUST and FedRAMP each are, which ones a customer or a contract can force on you, and how a manager chooses between a framework, a certification and an attestation.
  5. PCI DSS and Payment Security: The Contract Standard Behind Every Card Swipe 24 min
    PCI DSS v4.0.1 for managers: who must comply, how merchant levels and SAQ types work, the 12 requirements, the March 31, 2025 future-dated items, scoping and tokenization, how penalties really arrive, and what Nevada, Washington and Minnesota do with card data.
  6. Federal Laws That Reach Your Business: FTC, GLBA, HIPAA, FCRA, COPPA, CAN-SPAM, TCPA, Wiretap, SEC and CIRCIA 30 min
    Which federal privacy and security laws actually bind a business of 10 to 500 people, what each demands in plain terms, the notice clocks that start when something goes wrong, a decision table for 'which law applies to me,' and where each rule stands as of October 2026.
  7. State Privacy, Breach Notice and Data Security Laws: What Bites on a Business 26 min
    How the 50 state breach notice laws work, Idaho Code 28-51-104 to 107 in detail, where Idaho stands on a full consumer privacy law as of October 2026, the 23 states that have one, California's CCPA and its new audit rules, the sector laws (health data, biometrics, AI) and the state data security statutes, plus a multi-state strategy and its limits.
  8. International Privacy for US Businesses: GDPR, UK, Canada and Website Tracking 28 min
    When a small or mid-size US company falls under the EU GDPR, UK GDPR, Canada's PIPEDA or Quebec's Law 25, how personal data legally moves from Europe to the United States, what the EU-US Data Privacy Framework's legal status is as of October 2026, and how cookie banners, tracking pixels and California wiretap suits fit in.
  9. Vendors, Contracts and Third-Party Risk 30 min
    How a 10 to 500 person business inventories and tiers its vendors, reads a SOC 2 report, writes the contract clauses that the FTC Safeguards Rule, HIPAA, GDPR and Idaho law point to, controls SaaS sprawl and software supply chain risk, handles acquisitions, and answers the security questionnaires customers send.
  10. People, Policies and Training 28 min
    The policy set a 10-to-500-person business needs, how policy, standard and procedure differ, training and phishing simulations that work, insider risk, hiring and offboarding within the law, and what employee monitoring law allows.
  11. Detection, Incident Response and Notification 32 min
    Who watches the alerts, what an incident response plan must contain, how to run a tabletop exercise, which notice clocks start when you discover a breach, what the ransomware payment rules say, and how to work with the FBI, CISA and the Secret Service.
  12. Continuity, Recovery and Cyber Insurance 32 min
    How to run a business impact analysis, set recovery time and recovery point targets, build backups that survive ransomware and prove it with restore tests, and how cyber insurance works, what it excludes, what the application commits you to, and how to read a policy.
  13. Privacy Program, AI Governance and Board Reporting 32 min
    The working parts of a business privacy program, how to govern generative AI and shadow AI, where the state AI laws stand as of October 2026, how to control deepfake and voice-clone fraud, and how to report all of it to a board with a dashboard, a budget and a 12-month plan.
  14. Identity, Access and Device Control 32 min
    Who can get in, from what device, and for how long: single sign-on, the MFA strength ladder, joiner-mover-leaver and access reviews, admin and break-glass accounts, zero trust as a decision table, personal-device governance, and physical access and disposal.
  15. Vulnerabilities, Patching and Your Website 32 min
    How a 10-to-500-person business runs a patch and vulnerability program it can prove: severity-based deadlines built on the CISA Known Exploited Vulnerabilities list, scans versus penetration tests, end-of-life equipment, edge devices, domain and email hygiene, website and e-commerce security, secure software basics for firms that build for clients, and the metrics that show it works.
  16. Contracts That Raise the Bar: Federal and Defense Work, Idaho Public Sector and Sector Snapshots 36 min
    How FAR 52.204-21, DFARS 252.204-7012, SPRS scores, NIST SP 800-171 and CMMC reach a small contractor and its subcontractors as of October 2026, including the July 2026 suspension of CMMC Phase 2, plus what Idaho state and local agencies expect from vendors, what the Idaho Public Records Act can do to your proposal, and a sector snapshot for health, finance, education, HR, construction, tax and nonprofit managers.
  17. Records, Retention, Legal Holds and Workplace Privacy 32 min
    How to build a retention schedule from the federal minimums, stop deletion with a legal hold when a dispute or audit is coming, delete on purpose and prove it, and run employee monitoring, biometrics and children's data under one set of rules.
  18. Running the Program 45 min
    How to choose and contract an MSP, MSSP, MDR or virtual CISO, set a security budget in three tiers, prepare for cyber insurance underwriting, measure the program with 15 metrics, map one control to eight standards, and look up any term or deadline in the course.
moduleissues and advocacy training

Quote Verification Last Ran (October 27, 2026)

Open Privacy and Security for Small and Medium Businesses: A Management Guide to Layered Defense, Privacy Laws and Security Standards ↗

📘 Healthcare Cybersecurity and HIPAA Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

For people who run, staff, advise, report on or advocate around clinics, hospitals, health plans and their vendors: who HIPAA covers, the Privacy Rule and 42 CFR Part 2, the Security Rule safeguards and the status of the proposed Security Rule update, the risk analysis OCR expects, breach notification and the HHS breach portal, business associate agreements with cloud and AI vendors, medical device cybersecurity under FDA rules, OCR enforcement and hospital ransomware cases, and a small-clinic walkthrough with sample policies. Rules stated as of October 28, 2026. A module of Issues and Advocacy Training, 9 lessons.

What is included: 9 lessons and pages
  1. Who HIPAA Covers: Covered Entities, Business Associates and Protected Health Information 70 min
    HIPAA follows the organization, not the data. This lesson explains why the 1996 law ties coverage to electronic billing, who counts as a health plan, clearinghouse or covered provider, when a vendor becomes a directly liable business associate, what protected health information is and how it is de-identified, what HIPAA leaves out, and who enforces it, with worked examples from rural Idaho clinics to state Medicaid.
  2. The Privacy Rule in Practice: Permitted Uses, Minimum Necessary, Patient Rights and 42 CFR Part 2 70 min
    How the HIPAA Privacy Rule works as a permission system and how it turns into access controls, release workflows and logs: treatment, payment and operations, the 12 public interest permissions, minimum necessary and role-based access, authorizations, the Notice of Privacy Practices and each patient right with its deadline. Then 42 CFR Part 2 for substance use disorder records after the February 16, 2026 compliance d…
  3. The Security Rule: Safeguards, Required and Addressable Specifications, and the Proposed Update 60 min
    A section-by-section guide to the HIPAA Security Rule as enforced today, with every standard and implementation specification in one table, what "addressable" really requires, and how the 2021 recognized security practices law works. It then covers the January 2025 proposed rewrite in depth: what it would require, what HHS estimated it would cost, the comment fight, and its status as of October 28, 2026 (still propo…
  4. The Risk Analysis: What OCR Expects, How to Do One, and Why Organizations Fail 60 min
    The HIPAA risk analysis is the document OCR asks for first and finds missing most often. This lesson explains what 45 CFR 164.308(a)(1) requires, OCR's nine elements, the NIST SP 800-30 and SP 800-66 Rev. 2 methods, the free HHS SRA Tool, a worked risk register for a 12-person clinic, and what OCR's Risk Analysis Initiative cases show about why organizations fail.
  5. The Breach Notification Rule: The Four-Factor Test, the 60-Day Clock and the HHS Breach Portal 60 min
    How the HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414) decides whether an incident is a reportable breach, how the four-factor risk assessment and the encryption safe harbor work on real situations, and how the 60-day clock, the notice letters, media notice and HHS reporting fit together. It also shows how to read the HHS breach portal, how the FTC rule covers health apps, and how Idaho's breach law runs…
  6. Business Associate Agreements and Vendors: Cloud, IT Providers and AI Tools 60 min
    When a vendor is a HIPAA business associate, what a business associate agreement must contain under 45 CFR 164.504(e) and 164.314(a), and what the HHS sample provisions leave out. How to check health care vendors, why IT providers, remote access tools and website tracking pixels are top risks, and how the ordinary rules apply to AI scribes, chatbots and coding tools, with a decision chart, a lifecycle graphic and a …
  7. Medical Devices and Clinical Technology: FDA Cybersecurity Rules, Legacy Devices and Segmentation 60 min
    How connected medical devices differ from office IT, what FDA's section 524B and its 2016 and 2026 cybersecurity guidance require of device makers, and what hospitals and clinics do on their side: inventory, segmentation, MDS2 forms, SBOMs, procurement terms and vulnerability management with makers. Real cases from Abbott pacemakers to Contec patient monitors are stated from FDA and CISA sources, with a strong safet…
  8. Enforcement and Real Cases: OCR Penalties, Settlements and Hospital Ransomware 60 min
    How the HHS Office for Civil Rights enforces HIPAA, from complaints and breach reports to resolution agreements, civil money penalties and appeals, with the current penalty amounts as of October 28, 2026. The lesson covers the MD Anderson court loss, criminal and state attorney general enforcement, OCR's ransomware, risk analysis and right of access cases through October 2026, and the hospital ransomware attacks beh…
  9. A Small Clinic Walkthrough: From Risk Analysis to Written Policies, with Sample Policies 85 min
    A guided case: an invented rural Idaho family practice with 3 providers and 9 staff builds a HIPAA security program over 12 months, from naming its officials and running the free HHS SRA Tool to fixing its top risks with HICP and the HHS Cybersecurity Performance Goals, writing policies, training staff and testing with tabletop exercises. Includes ten original sample policies and worksheets, each tied to the Securit…
moduleissues and advocacy traininghipaahealth carecybersecurityprivacy

Open Healthcare Cybersecurity and HIPAA ↗

📘 Cybersecurity for Legal, Accounting and Professional Services Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

For lawyers, CPAs, tax preparers, bookkeepers, financial advisers, consultants and their staff and IT providers: the duties of competence and confidentiality under the Idaho Rules of Professional Conduct and the ABA opinions, client data, e-discovery, cloud and AI tools, trust accounts and client money, the FTC Safeguards Rule and IRS rules for tax and accounting firms, engagement letters and incident response, and business email compromise and wire fraud, with sample policies. Rules stated as of October 28, 2026. A module of Issues and Advocacy Training, 6 lessons.

What is included: 6 lessons and pages
  1. The Duty to Protect Client Information: Competence, Confidentiality and Supervision 65 min
    The Idaho Rules of Professional Conduct make data security a professional duty for lawyers through Rule 1.1 Comment [8], Rule 1.6(c) and the supervision rules, and the ABA formal opinions from 1995 to 2025 explain what reasonable efforts look like. This lesson compares the Idaho and ABA texts, explains who enforces the duty in Idaho, notes accountants' parallel duties, and shows what reasonable efforts look like for…
  2. Client Data, E-Discovery, Cloud and AI Tools: Where Client Files Live and How to Keep Them Confidential 55 min
    How law, accounting and other professional firms map and classify client data, handle it in e-discovery under the federal and Idaho rules, and keep it confidential with legal holds, protective orders, cloud and e-discovery vendors and generative AI tools. Covers Idaho Rule 1.16A on client files, HIPAA qualified protective orders, ABA Formal Opinion 512, secure disposal and real law firm breaches, with a sample clien…
  3. Trust Accounts and Client Money: IOLTA, Wire Instructions and Who Bears the Loss 55 min
    How Idaho Rule of Professional Conduct 1.15 and Idaho Bar Commission Rules 1301 to 1309 govern client money, why the Client Assistance Fund does not appear to cover theft by outside criminals, and how changed wire instructions, counterfeit cashier's checks and payoff letter fraud drain trust and escrow accounts. Covers who bears the loss under Beau Townsend Ford, Idaho's enactment of UCC Article 4A and North Carolin…
  4. Accounting, Tax and Financial Firms: The FTC Safeguards Rule, IRS Requirements and the Written Security Plan 60 min
    Tax preparers and accountants are financial institutions under the FTC Safeguards Rule, which now requires a Qualified Individual, encryption, multi-factor authentication, vendor oversight and a 30-day FTC notice for breaches affecting 500 or more consumers. This lesson walks through every element of 16 CFR 314.4, the small-firm exemption, IRS publications and reporting rules, section 7216, AICPA and Idaho accountan…
  5. Engagement Letters, Incident Response and Telling Clients: When a Professional Firm Is Breached 60 min
    What engagement letters, client security demands and cyber insurance applications should say before anything goes wrong, and who a law, accounting or tax firm must tell after a breach: clients under Idaho Rules 1.4 and 1.6 and ABA Formal Opinion 483, the FTC, the IRS, the SEC and affected people under Idaho Code 28-51-105. Includes an incident response plan for a 5 to 20 person firm, a timeline from the first hour t…
  6. Business Email Compromise and Wire Fraud at Professional Firms: How It Happens and How to Stop It 70 min
    Business email compromise is where law, accounting, tax and other professional firms and their clients lose the most money: $3,046,598,558 in reported U.S. BEC losses in the FBI's 2025 report. This lesson explains how the frauds work so staff can recognize them, which firm moments criminals aim at, the layered defenses that stop them (with the callback on a known number at the center), what to do in the first hour a…
moduleissues and advocacy trainingcybersecuritylaw firmsaccountingtax preparerswire fraudprivacy

Open Cybersecurity for Legal, Accounting and Professional Services ↗

📘 Cybersecurity for Manufacturing and Industrial Control Systems Learning Module

Free lessons with sources, a short quiz and progress saved in your browser.

For plant managers, controls engineers, maintenance and IT staff, small manufacturers, utility, water and pipeline operators and defense suppliers: how plant systems (OT) differ from office IT, the Purdue model, ISA/IEC 62443 and NIST SP 800-82, real attacks from Colonial Pipeline and NotPetya to 2026, remote access and vendors, patching without stopping production, safety and security together, the sector rules (NERC CIP, TSA pipeline directives, CMMC, FDA) and a plant-floor segmentation plan, with sample policies. Rules stated as of October 28, 2026. A module of Issues and Advocacy Training, 7 lessons.

What is included: 7 lessons and pages
  1. IT and OT: How Plants Differ, and the Purdue Model 65 min
    What operational technology is, how a plant's control systems differ from office IT, and what each part of an industrial control system does, walked through on one example line. Where the Purdue model came from, what its levels and the industrial DMZ mean, how NIST SP 800-82 and ISA/IEC 62443 use or move beyond it, the OT threat picture in brief, and who is affected in Idaho.
  2. The Standards: ISA/IEC 62443 and NIST SP 800-82 60 min
    ISA/IEC 62443 and NIST SP 800-82 are the two main standards for securing factory and plant control systems. This lesson explains 62443's parts, roles, zones and conduits, foundational requirements, security levels and certification; what NIST's OT guide, its overlay and its September 2026 draft revision cover; and how CISA's goals and 2025 to 2026 OT guides, the CSF Manufacturing Profile and MITRE ATT&CK for ICS fit…
  3. ICS Threats and Real Cases: Colonial Pipeline, NotPetya and What Came After 60 min
    Who attacks factories, utilities, pipelines and water systems, and why, with the 2025 and 2026 data from Dragos, IBM, Verizon, the FBI and CISA. Then the record of the major cases, from Stuxnet and the Ukraine grid attacks through Triton, NotPetya, Norsk Hydro, Colonial Pipeline, Aliquippa, Volt Typhoon, Clorox and Jaguar Land Rover to the 2026 attacks on PLCs and water systems, told from testimony, filings, indictm…
  4. Remote Access, Vendors and the Supply Chain 60 min
    Remote access is how most attackers reach a plant, from Colonial Pipeline's old password-only VPN account to the internet-exposed PLCs disrupted in 2023 and 2026. This lesson shows how to find every remote path, the secure remote access practices NIST, CISA and the 2026 connectivity principles agree on, what NERC and TSA already require, and how to handle vendors, integrators, SBOMs and software integrity, with a sa…
  5. Patching Without Stopping Production, and Keeping Safety and Security Together 70 min
    Why plant-floor patching is hard, what NIST SP 800-82 Rev. 3 asks for, how to rank vulnerabilities with CISA KEV and SSVC, and how to protect what cannot be patched with compensating controls, backups, golden images and management of change. The second half explains process safety, safety instrumented systems, OSHA PSM hazard analysis, cyber PHA, and Idaho National Laboratory's Cyber-Informed Engineering methods, wi…
  6. Sector Rules: NERC CIP, TSA Pipeline Directives, CMMC, FDA and More 70 min
    There is no single federal cybersecurity law for manufacturers: which rules reach a plant depends on what it makes, who it sells to, what it owns and whether it is publicly traded. This lesson explains each rule that can reach an industrial operator, from NERC CIP, the TSA pipeline directives and DFARS, NIST SP 800-171 and CMMC (including the July 13, 2026 suspension of Phase 2) to FDA section 524B, water, chemical …
  7. A Plant-Floor Segmentation Plan, Step by Step 75 min
    A worked example that takes one invented 120-person southern Idaho metal-parts plant from a flat network to zones, conduits and an industrial DMZ, in eight steps that follow NIST SP 800-82 Rev. 3, ISA/IEC 62443-3-2 and CISA's 2025 and 2026 OT guidance. It includes a before and after network drawing, a zones-and-conduits table, a phased 90-day, 6-month and 12-month timeline, costs and free help for small manufacturer…
moduleissues and advocacy trainingcybersecuritymanufacturingindustrial control systemsOTSCADANERC CIPCMMCIdaho

Open Cybersecurity for Manufacturing and Industrial Control Systems ↗

Other sections