Practical Advice for Preventing Organizational Data Breaches

This course is built specifically for you. Steve walks through real examples of small-to-mid-sized practices, including a firm he worked with that had 40 staff locked out by ransomware in January, and how a one-person breach can cascade through your entire client base because you hold Social Security numbers, tax returns, and banking details. The tactics covered—phishing, deepfakes, vendor compromise—don't target only Fortune 500 companies; they target you as low-hanging fruit with access to high-value data.

You don't need a technical background. Steve uses plain language throughout and avoids jargon where he can; when technical terms come up, he explains them—for example, explaining encryption as 'obfuscation' that makes data password-protected and inaccessible. The course focuses on decisions you make and processes you implement, not on configuring software yourself. He even addresses the objection 'we have an IT provider—it's their problem' and explains why you remain accountable regardless.

You'll be able to build a 30-60-90 day plan with concrete steps: inventory your vendors and devices, upgrade from password-only login to two-factor authentication or passkeys, test whether your backups actually restore, draft a written information security plan (WISP) required by the IRS anyway, and set protocols so staff can safely raise security concerns without penalty. Steve gives worked examples—like how to verify a vendor's changed bank details by calling them on a number you already have, not the one they emailed.

Very hands-on. Steve recounts a ransomware attack he witnessed where a managing partner's voice and video were deepfaked to trick an accountant into wiring money; he describes the anatomy of how attackers move laterally through networks once they're in; he covers specific vendors (365, AWS, SolarWinds) and actual authentication methods (passkeys, FIDO2, YubiKey) with concrete guidance like 'do not call the number in their email—Google the vendor's real number.' He also shares his own security setup: five backup copies of critical data tested daily, separate business and personal networks, and his decision last week to move some data from cloud back to on-premises servers for data sovereignty.

Yes. The course covers GLBA (Gramm-Leach-Bliley Act), FTC safeguard rules, IRS Circular 230, and WISP (written information security plan) requirements. Steve explains that you must have a named qualified individual responsible for security, conduct a risk assessment, encrypt data, use multifactor authentication, train staff, and review the plan annually. He stresses these are not optional: they are mandatory frameworks for professional responsibility if you practice in front of the IRS or hold consumer financial data.