Troy you have bulleted out most items of interest, I would also advise you to add mitigation methods: as a computer scientist I am shocked that more conglomerat

Troy you have bulleted out most items of interest, I would also advise you to add mitigation methods: as a computer scientist I am shocked that more conglomerates are not legally obligated to encrypt information and also ensure that information is only decrypted while it's being used and looked at. Data that is not being currently used should be hashed and inaccessible to someone without the credentials (unless you're the NSA and have the brute force to work the search space). Data, like a person's address and social security number, can be encrypted such that we only need a small portion of the correct data to decrypt the entry, but we need to tie the ends of the conversation together: "can I have your secret answer and last 4 digits of your SSN?" should actually initiate the decryption of the data, and should be a real preventative layer instead of just a delay for the clever social engineering ploy. So please recommend that conglomerates be forced to encrypt data in ways that protects the vast majority of accounts in case of a data breach. Thanks a lot for taking the initiative to ask the community, regards to you my friend in freedom.