🏛️ Issues and Advocacy Training™
Courses › Privacy and Data Security Laws™

Lesson 11 of 11 · about 18 minutes

Mitigation and Best Practices

You'll be able to

  • Take the five protective steps that matter most after a breach letter
  • Apply data minimization, multifactor login, encryption and access control in a small organization
  • Build a breach response timeline from the strictest law that applies to your data
  • Name and use NIST CSF 2.0, the CIS Controls, the FTC's Start with Security and CISA's Cyber Essentials
  • Cite the course's key figures with their sources

Start here: the short version

  • After a breach letter: freeze your credit at all three bureaus, get an IRS IP PIN, change reused passwords, turn on multifactor login, and report fraud at IdentityTheft.gov.
  • For an organization, the cheapest security is data you never collected. Collect less, keep less, delete on a schedule.
  • Multifactor login and encryption do most of the work. Encryption with a safe key also usually keeps a lost laptop outside the breach laws.
  • Write the response plan before you need it, with the notice clock set by the strictest law that applies to your data.
  • Use a framework instead of inventing one: NIST CSF 2.0, CIS Controls IG1, the FTC's Start with Security, CISA's Cyber Essentials.

The first ten lessons were about what the law requires. This one is about staying out of the situations those laws describe, and recovering fast when you land in one anyway. It is short on purpose. The longer practical guides live in the Privacy Guide special edition and in courses 71, 72 and 73, linked throughout.

If you got a breach letter

Breach letters are written by the organization that lost your data, and they tend to say what the law requires and little more. What you do next matters more than what the letter says.

How to: protect yourself in the first hour

  1. Freeze your credit at Equifax, Experian and TransUnion, online or by phone. The FTC says there is no cost to place or lift one and a freeze lasts until you lift it. Lift it for a day when you apply for credit.
  2. Get an IRS Identity Protection PIN. The IP PIN is a six-digit number valid for one calendar year; a new one is issued each year. Anyone with a Social Security number or ITIN who can verify identity is eligible, online through an IRS account, by Form 15227 for filers under the income limits, or in person at a Taxpayer Assistance Center.
  3. Change passwords on the breached account and on every account that shared the password. A password manager makes unique passwords painless.
  4. Turn on multifactor login for email, banking, phone carrier and social accounts, preferably with an authenticator app or security key rather than text messages. Your email account is the master key to the rest.
  5. Watch accounts and statements, and pull your free credit reports. If you see fraud, report it at IdentityTheft.gov, which builds a personal recovery plan, and file a police report and a complaint with your attorney general (in Idaho, the Consumer Protection Division; lesson 10).

A fraud alert is the lighter alternative to a freeze: an initial alert lasts one year and can be renewed, and an extended alert for identity theft victims lasts seven years. Accept free monitoring if it is offered, but treat it as a smoke detector, not a lock. Course 71's lessons on money, credit and identity and when things go wrong walk through each step at home.

For small businesses, nonprofits and campaigns

Collect less, keep less, delete on a schedule

The FTC's Start with Security guide opens with three lessons that cost nothing: don't collect personal information you don't need, hold on to it only as long as you have a legitimate business need, and don't use it when it isn't necessary. The FTC Safeguards Rule turns that into a rule for financial institutions: 16 CFR 314.4(c)(6) requires secure disposal of customer information no later than two years after it was last used to serve the customer, with limited exceptions.

In practice, minimization looks like this for a small group. A volunteer sign-up sheet does not need birth dates. A donor database does not need full card numbers, because the payment processor holds them. An event list from three years ago can go. Every field you drop is a field that cannot leak, and Social Security numbers, license numbers and full account numbers are the fields that trigger Idaho's breach law (lesson 10).

Lock the doors: multifactor login and access control

Most breaches of small organizations start with a stolen password or a phished email account. Multifactor login stops most of those. The Safeguards Rule requires multifactor authentication "for any individual accessing any information system" unless the organization's Qualified Individual approves an equivalent control in writing. Even where no rule requires it, it is the single best control for its cost.

Access control is the second door. Give each person their own account, never a shared login. Give each account only what that person needs. Remove access the day a staffer or volunteer leaves. Review who has admin rights every quarter. For campaigns, that last step matters most at the end of a cycle, when dozens of short-term accounts tend to linger.

Encrypt, and keep the key separate

The Safeguards Rule requires encryption of customer information "both in transit over external networks and at rest," with compensating controls only where encryption is infeasible. For everyone else, encryption is a strong idea with a legal bonus. Nearly every state breach law and the HIPAA rule treat data encrypted to a recognized standard, with the key kept safe, as outside the notice duty (lessons 01 and 09). Turn on full-disk encryption on every laptop and phone (most current devices include it), use the encrypted options your cloud storage provides, and never store the password or key with the device. A stolen encrypted laptop is a hardware loss. A stolen unencrypted laptop with a donor spreadsheet may be a breach.

Vendors and contracts

Your data is only as safe as your weakest vendor. The Safeguards Rule's 314.4(f) requires financial institutions to select capable service providers, require safeguards by contract, and periodically assess them. HIPAA requires a business associate agreement (45 CFR 164.504(e); lesson 03). For everyone else, the same three steps are good practice. Put in writing that the vendor will protect the data, notify you of a breach within a fixed short time (days, not "promptly"), cooperate with the investigation, and delete or return the data at the end. State laws make the vendor tell you; the contract decides how fast and who pays for the letters. Course 72's payment cards, customer data and records lesson covers PCI DSS, the card industry's contract standard, which is not a law but binds any group that takes cards.

A written plan with the right clock

The Safeguards Rule requires a written incident response plan covering goals, internal processes, roles, communications, remediation, documentation and a post-incident review (314.4(h)), for institutions with customer information on 5,000 or more consumers. Every organization should have one, even if it fits on two pages. The key number in it is the notice deadline, and the right deadline is the strictest one among the laws that apply to your data.

If you holdThe clock to plan aroundSource
Data on residents of Washington, California, Colorado, Florida, Maine or New York30 days to notify individuals (calendar days in California and Washington)Lesson 09 table
Customer information at a non-bank financial institution, 500 or more consumers30 days to the FTC16 CFR 314.4(j)
Protected health information60 calendar days to individuals; HHS and media rules by size45 CFR 164.404 to 408
Data held for an Idaho public agency (or as one)24 hours to the Idaho Attorney GeneralIdaho Code 28-51-105
Data held for another organization (you are the vendor)Immediately to the owner in Idaho; 10 days in Oregon; 24 hours in GeorgiaLesson 09
Only Idaho residents' data, no federal ruleMost expedient time possible, without unreasonable delayIdaho Code 28-51-105

How to: write a two-page incident response plan

  1. Name the incident lead and a backup, with phone numbers that work if email is down.
  2. List the systems and the data each holds, and which states' residents are in it.
  3. Write the first steps: isolate affected devices, preserve logs, change credentials, call the IT vendor and the insurer.
  4. Set the notice clock from the table above and list who gets told: residents, regulators, credit bureaus, the board, donors.
  5. Keep a template letter that meets the strictest content rules (California's headings work everywhere).
  6. Test it once a year with a one-hour tabletop exercise, and update it after any real incident.

Backups, training and insurance

Ransomware turns a data problem into an operations problem. Keep at least one backup copy offline or in a service that cannot be altered from your network, and test a restore. Train people on the one thing that matters most, which is spotting a phishing email and reporting it fast, without fear of blame. Cyber insurance can pay for forensics, letters and call centers; read what it excludes and whether it requires multifactor login and backups as conditions of coverage, since an unmet condition can void a claim. Course 73's detection, incident response and notification lesson and course 72's when something goes wrong go further.

Donor, volunteer and voter data

Campaigns and advocacy groups hold some of the most sensitive data a small organization can have: political preferences, home addresses, phone numbers, sometimes payment details. Use a payment processor so card numbers never touch your systems. Read the use terms that come with any voter file and keep the file only as long as those terms allow. Keep volunteer records free of Social Security and license numbers unless a background check truly needs them, and then store them with the vendor that runs the check. Course 63, digital campaigning on a small budget, and course 61, starting a nonprofit or advocacy group, cover the tools; texting and calling rules are in course 46's lesson on literature, signs and ads.

Frameworks worth using

  • NIST Cybersecurity Framework 2.0, published February 26, 2024. Six functions: Govern, Identify, Protect, Detect, Respond and Recover. Good for organizing a program and explaining it to a board.
  • CIS Controls v8.1, Implementation Group 1. CIS calls IG1 essential cyber hygiene: a foundational set of 56 safeguards, and says a typical IG1 enterprise is small to medium-sized with limited IT and cybersecurity expertise. Good as a to-do list.
  • FTC, Start with Security. Ten lessons drawn from the FTC's own cases. Good for knowing what the FTC has called unreasonable.
  • CISA, Cyber Essentials. CISA's starter guide for small organizations and their leaders.

One-page checklist

  • We know what personal data we hold, where, and whose (which states).
  • We collect no Social Security, license or full card numbers we do not need.
  • We delete old data on a written schedule.
  • Every account uses multifactor login; there are no shared logins.
  • Access is removed the day someone leaves.
  • Laptops and phones are encrypted; keys and passwords are stored separately.
  • Vendor contracts require safeguards, fast breach notice, cooperation and deletion.
  • Backups exist offline or immutable, and a restore was tested this year.
  • A written incident plan names the lead and sets the notice clock from the strictest law.
  • Staff and volunteers know how to report a suspicious email.
  • We know our regulator: the Idaho Attorney General, plus HHS, the FTC or others as our data requires.

Common mix-ups

  • Claim: We are too small to be a target. What the evidence shows: The Idaho Attorney General's breach list is full of school districts, counties, small firms and clinics. Automated attacks do not check size.
  • Claim: Credit monitoring protects you. What the evidence shows: Monitoring reports fraud after it happens. A free freeze prevents most new-account fraud.
  • Claim: The cloud provider handles security. What the evidence shows: Providers secure their platform. Your settings, accounts and passwords are yours, and the AT&T records theft in lesson 09 came from a company workspace on a third-party cloud platform.
  • Claim: A breach plan is a big-company thing. What the evidence shows: The Safeguards Rule requires a written plan of every covered financial institution with customer information on 5,000 or more consumers, which includes many small tax preparers and auto dealers, and the 30-day FTC notice applies to all of them. Two pages beat none.

Reporting angle

After any local breach, ask the organization: did it use multifactor login on the compromised account, was the data encrypted and where was the key, how old was the data and why was it still kept, which vendor was involved and what the contract says about notice, and whether it had a written incident plan and followed it. For public agencies, request the incident plan, the last security audit summary and the cyber insurance policy's conditions under the Public Records Act, expecting some security details to be withheld. Numbers to check: how long the data was kept against the organization's own retention schedule.

Go further

Questions and answers

Does a freeze hurt my credit score?

No. A freeze limits who can pull your report for new credit. Your existing accounts and score are unaffected, and you can lift it when you apply.

Is text-message multifactor login good enough?

It is far better than none. Authenticator apps and security keys resist phone number takeovers and phishing better, so use them for email and banking where offered.

How long should a small group keep donor records?

As long as a law or your accountant's records needs require, and no longer. Write the period down. Tax and campaign finance rules set some minimums; everything past them is risk with no benefit.

Our volunteer coordinator uses a personal email. Is that a problem?

Yes. You cannot enforce multifactor login, remove access, or preserve records on an account you do not control. Give every volunteer with data access an organization account.

Do we need cyber insurance?

It depends on what you hold and what a breach would cost you in letters and downtime. If you buy it, meet its conditions, because the insurer will check them after a claim.

Who do we tell first after a breach?

Follow your plan: contain it, preserve evidence, call your IT help and insurer, then work through the notice table. If you are an Idaho public agency, the Attorney General's 24-hour clock runs from discovery.

Hard questions

Should small organizations be held to the same security rules as large ones?

Under 16 CFR 314.6, financial institutions with customer information on fewer than 5,000 consumers are excused from the written risk assessment, continuous monitoring or annual penetration testing, the written incident response plan and the annual report to the board, but not from multifactor login, encryption or the FTC breach notice. Small business advocates argue that compliance costs fall hardest on them. Privacy advocates answer that a leaked Social Security number causes the same harm whoever lost it. The frameworks above scale on purpose, which is one practical answer.

Is it fair to blame breach victims, the organizations, when attackers are criminals?

Organizations argue they are crime victims too, and that liability should depend on unreasonable security, not on being hit. Regulators agree in principle: the FTC and state laws judge reasonableness, not outcomes. Consumer advocates add that the organization chose to collect and keep the data, so it should carry the cost of protecting it.

Should paying a ransom be allowed?

Some argue that paying funds more attacks and should be barred, at least for public bodies. Others argue that a hospital or a town facing days of downtime needs the option. Federal law reaches the question at the edges: CIRCIA, the 2022 critical infrastructure reporting law, provides for reports of ransom payments once CISA's rule is in force (lesson 07 has its status).

Monitoring or freezes as the standard remedy?

Many breach settlements and some state laws make free monitoring the standard offer. Critics argue a freeze, which is already free, does more, and that monitoring offers can be a marketing channel. Supporters say monitoring catches fraud on existing accounts that a freeze does not stop. Doing both is the safe answer for an individual.

Pictures, Numbers and Infographics

The figures below are the course's key numbers, each checked against its source in October 2026.

FigureNumberSource
Jurisdictions with breach notice laws54: all 50 states, D.C., Guam, Puerto Rico and the U.S. Virgin IslandsNCSL
States with broad consumer privacy laws23 enacted as of October 2026, 19 in effect: 19 enacted from 2018 through 2024 with none added in 2025, per IAPP, plus Oklahoma, Alabama, Louisiana and Vermont in 2026, effective 2027 or 2028 (lesson 08 has the list)IAPP; lesson 08; Vermont S.71; Louisiana SB 386
Idaho broad consumer privacy lawNone, as of October 2026Lesson 10; legislature.idaho.gov bill lists
Breach notices posted by the Idaho Attorney General94 dated in 2025 (a few are supplemental or repeat notices); 42 dated in 2026 through October 22Idaho AG (count of posted entries, October 26, 2026)
FBI IC3 complaints, 20251,008,5972025 IC3 Report
FBI IC3 reported losses, 2025$20.877 billion2025 IC3 Report
IC3 personal data breach complaints and losses, 202567,456 complaints; $1,314,923,9882025 IC3 Report
HHS OCR: breaches of 500 or more individuals that occurred in 2024663 reports, affecting about 242,908,056 individuals; plus 74,299 reports of smaller breachesHHS OCR Annual Report to Congress, calendar year 2024
Largest FTC privacy penalty$5 billion, Facebook, July 24, 2019FTC
Texas biometric settlement with Meta$1.4 billion over five years, July 30, 2024 (CUBI and DTPA)Texas AG
Texas settlement with Google$1.375 billion settlement in principle, announced May 9, 2025 (geolocation, incognito search and biometric data claims)Texas AG
Largest COPPA penalty$275 million, Epic Games, December 2022 (plus $245 million in refunds on other claims)FTC
Equifax breach, 2017147 million people; settlement up to $425 million for affected people (2019)FTC
Change Healthcare breach, 2024About 192.7 million individuals (as of July 31, 2025)HHS OCR
Shortest fixed state notice deadline30 days (California, Colorado, Florida, Maine, New York, Washington)Lesson 09
The biggest privacy penalties and settlements (millions of dollars) Facebook, FTC, 2019 5,000 Meta, Texas, 2024 1,400 Google, Texas, 2025 1,375 Equifax, 2019 (up to) 425 Epic Games, COPPA, 2022 275 Bars to scale: 450 pixels equals $5 billion. Sources: FTC (Facebook, Epic, Equifax); Texas Attorney General (Meta, Google). The Equifax figure is the amount for affected people, not the full settlement total.
One federal penalty is larger than the next four combined. Texas's two settlements came under its biometric and deceptive trade practices laws.
How long do you have? Breach notice clocks in days Idaho agency to AG 24 hours SEC Form 8-K (business days) 4 FCC carriers to police (bus. days) 7 6 states, to people 30 FTC Safeguards, 500+ 30 11 states, to people 45 5 states, to people 60 HIPAA, to people 60 Idaho businesses No fixed count: "most expedient time possible" Seven pixels per day. Sources: Idaho Code 28-51-105; SEC 2023-139; 47 CFR 64.2011; 16 CFR 314.4(j); 45 CFR 164.404; lesson 09 state table.
Plan to the shortest clock that applies. Every fixed deadline is also an outer limit on top of a duty to move without unreasonable delay.

Check yourself

1. Which single step blocks most new-account fraud after a Social Security number is exposed, at no cost?

2. Why does encrypting stored data matter for breach law, beyond security itself?

3. A campaign in Idaho holds donor card data and volunteers from Washington. What deadline should its response plan use for notifying people?

4. What does the IRS Identity Protection PIN do?

5. Which framework, released by NIST on February 26, 2024, organizes security work into Govern, Identify, Protect, Detect, Respond and Recover?

6. Under 16 CFR 314.6, which Safeguards Rule duty still applies to a small tax preparer with customer information on fewer than 5,000 consumers?

Terms in this lesson

Data minimization
Collecting only the personal data you need, keeping it only as long as you need it, and deleting it on a schedule.
Multifactor authentication
Login that needs a second proof, such as an app code or a security key, beyond the password. Required for anyone accessing systems under the FTC Safeguards Rule.
Incident response plan
A written plan naming who does what, in what order, when a security event happens, including the notice clocks that apply.
IP PIN
The IRS Identity Protection PIN: a six-digit number that changes every calendar year and must be on your federal return.
Implementation Group 1
The CIS Controls' starting set of 56 safeguards, described by CIS as essential cyber hygiene; CIS says a typical IG1 enterprise is small to medium-sized with limited IT and cybersecurity expertise.

Full glossary

Sources