Ramyar Daneshgar

NIST Risk Management Framework (RMF) Compliance Explained: What It Is, Why It Matters, and How to Get Compliant

By Ramyar Daneshgar Security Engineer | USC Viterbi School of Engineering Disclaimer: This article is for educational purposes only and does not constitute legal advice. What Is the NIST Risk Management Framework (RMF)? The NIST Risk Management Framework (RMF) is a formalized process created by the National Institute of Standards and

The Privacy Engineering Playbook for CPRA Compliance

By Ramyar Daneshgar Security Engineer | USC Viterbi School of Engineering Disclaimer: This article is for educational purposes only and does not constitute legal advice. Executive Summary This playbook is designed for privacy engineers, legal policy teams, and product compliance leads implementing CPRA requirements at scale. It translates the California Privacy

Understanding CPRA’s Data Minimization Clause: How Engineering & Legal Should Work Together

By Ramyar Daneshgar Security Engineer | USC Viterbi School of Engineering Disclaimer: This article is for educational purposes only and does not constitute legal advice. The California Privacy Rights Act (CPRA), which strengthens and extends the California Consumer Privacy Act (CCPA), places increased emphasis on data minimization as a core privacy

ISO/IEC 27001 Compliance Explained: What It Is, Why It Matters, and How to Get Compliant

By Ramyar Daneshgar Security Engineer | USC Viterbi School of Engineering Disclaimer: This article is for educational purposes only and does not constitute legal advice. What Is ISO/IEC 27001? ISO/IEC 27001 is the internationally recognized standard for establishing and managing an Information Security Management System (ISMS). Developed by the

Case Study: How SOC 2 Mistake Costed Drizly $1B in Damages

By Ramyar Daneshgar Security Engineer | USC Viterbi School of Engineering Disclaimer: This article is for educational purposes only and does not constitute legal advice. Executive Summary In 2020, Drizly - a fast-growing alcohol delivery startup - suffered a breach that exposed the personal information of 2.5 million customers. Although

SOC 2 Compliance Explained: What It Is, Why It Matters, and How to Pass the Audit

By Ramyar Daneshgar Security Engineer | USC Viterbi School of Engineering Disclaimer: This article is for educational purposes only and does not constitute legal advice. What is SOC 2? SOC 2 stands for System and Organization Controls 2, a compliance framework developed by the American Institute of Certified Public Accountants (AICPA)

Case Study: BetterHelp - How Behavioral Advertising Mistake Costed $7.8M in FTC Fine

By Ramyar Daneshgar Security Engineer | USC Viterbi School of Engineering Disclaimer: This article is for educational purposes only and does not constitute legal advice. In March 2023, the Federal Trade Commission (FTC) finalized a $7.8 million enforcement action against BetterHelp, a prominent online mental health platform. This case reveals

How to Audit a Client’s Privacy Notice Like a Regulator Would

By Ramyar Daneshgar Security Engineer | USC Viterbi School of Engineering Disclaimer: This article is for educational purposes only and does not constitute legal advice. In the eyes of the Federal Trade Commission (FTC) and California Privacy Protection Agency (CPPA), a privacy notice is a public declaration about how a company

Shopify Merchants Lose $20 billion Due This One Risk - Here's How You Can Detect, Combat, & Prevent It

By Ramyar Daneshgar Security Engineer | USC Viterbi School of Engineering Disclaimer: This article is for educational purposes only and does not constitute legal advice. As cybersecurity professionals, it is crucial to advise your Shopify Merchant clients on how to protect their businesses from social engineering attacks, especially phishing scams. These

Case Study: How a Few Lines of Meta Pixel JavaScript Exposed Millions of Patient Records

By Ramyar Daneshgar Security Engineer | USC Viterbi School of Engineering Disclaimer: This article is for educational purposes only and does not constitute legal advice. Introduction Over the past two years, major healthcare providers in the U.S. embedded Meta Pixel - a tracking tool by Facebook - into their patient

Expansion of ICTS Supply Chain Regulations by the Department of Commerce

By Ramyar Daneshgar Security Engineer | USC Viterbi School of Engineering Disclaimer: This article is for educational purposes only and does not constitute legal advice. The U.S. Department of Commerce has significantly expanded its regulations under the Information and Communications Technology and Services (ICTS) supply chain rules, which are designed

Dark Patterns in Cookie Banners: The Overlooked Compliance Risk Facing U.S. Businesses

By Ramyar Daneshgar Security Engineer | USC Viterbi School of Engineering Disclaimer: This article is for educational purposes only and does not constitute legal advice. What Are Dark Patterns in Cookie Banners? Dark patterns are deceptive or manipulative user interface (UI) and user experience (UX) design choices that interfere with a