There’s a material difference between a situation in which an organization took no action to safeguard personal information, and one in which a business maintained information security practices that proved imperfect. In both scenarios, a breach occurred. But only in the latter will evidence document that the organization took reasonable steps to protect its data.

Many companies have adopted an approach for assessing and managing risks, current or anticipated, from changing regulations. These generalized risk management methods often struggle to address existing and evolving information security risks, such as ransomware attacks, breaches of customer data and compromised corporate secrets. Cybersecurity and data privacy issues loom large for all industries but particularly challenge organizations newly grappling with InfoSec requirements. For example, those who have recently crossed the number-of-employees or revenue thresholds many regulatory bodies apply to determine applicability of InfoSec statutes, or those who have expanded into geographic areas where data is regulated.