I have started to put together some resources to teach C suite, maybe new-to-the-field lawyers, other interested stakeholders - about website compliance issues..

looking to mimic other good training / learning materials, extra info to consider, maybe collab and send business I can't take on, etc.

There are some out-of-the-box solutions that can start you on your way to creating a security awareness training program, such as KnowBe4 and ProofPoint (there are others as well, but these are some of the big names). If you don't have in-house security staff, these types of offerings can be quite helpful.

For a more grounds-up approach, there are guidelines such as the NIST SP 800-50 "Building a Cybersecurity and Privacy Learning Program" guidance. (https://csrc.nist.gov/pubs/sp/800/50/r1/final)

If you have specific questions, I can try to answer them.

And, from my experience, many of the trainings that seem almost offensively easy to me (e.g. "How to read a URL") have been some of the ones that received the most positive feedback from non-technical departments.

The real key with security awareness training is ensuring the training is at the appropriate level of complexity for the trainee.

Appreciate you and @ziddoap offering insight!

Looking at starting deck for FTC issues, Hipaa issues, and Google's policies - all for websites and apps specifically very soon and let the videos / webinars / interactive / discussions grow from here.

Then you get people on HN shouting "regulatory capture!" and "stifling innovation!"

It's also disproportionate. If my email is leaked in the context of receiving treatment for a stigmatized disease, that's a lot worse than an MMORPG leaking my real name.

Maybe some penalty is necessary but $10k or above per user is disproportionate for the vast majority of people. A $50/person penalty with gradations for sensitivity of the information is going to work better in practice. If leaking an SSN is more expensive than an email or site-specific ID, corporations might stop using SSNs to identify people to reduce their exposure

If the outcome of ignoring data security is to not make any money then companies will actually do something about it.

Penalities should push the company to the point of failing.

You phrasing it like this is not a substitute for explaining why it wouldn't be those things.

Also, the most obvious thing is: if you're a healthcare provider, you would probably hire some hackers to go after your competition, and let heavy-handed fines take them down. Much easier than providing better value.

I got a letter telling me they gave away my information with a link to an “identity monitoring” site that looks like the CEOs nephew built in a weekend and just errors out when I sign up.

Even better, the consequences are stronger in the event that the company obviously wasn't giving a fuck about security.

I wish we had HIPAA for all PII.