https://www.sans.org/reading-room/whitepapers/compliance/tech-startup-about-security-privacy-compliance-35792