## 5 Discussion
### Vulnerabilities Mitigation  
To ensure the proper protection of customers' data and compliance with these regulations, a company must effectively implement security controls that mitigate the vulnerabilities that could lead to a breach. Different incident types require different security countermeasures as mitigation. As seen in Figure 15, data breaches in 2023 were most frequently caused by phishing attacks, and the most costly originated with malicious insiders (INSDs) [58]. However, when categorizing these attack vectors into the types of the dataset, it was observed that the majority of them were related to hacking activities (HACK). The 'Accidental' label in the figure may be associated with the union of the DISC, PHYS, STAT, and PORT types of the dataset, while 'Physical' may be associated with the union of PHYS, STAT, and PORT. Social engineering and phishing, which may be considered a type of social engineering, are not strictly related to a category of the dataset. This also complements the analysis of the dataset, informing the financial impact for different attack vectors, which is important to consider in a risk assessment and in prioritizing vulnerabilities mitigation. As an example, according to Section 4.4, HACK data breaches represent the second-most-frequent cause, and also correspond to significant average costs, as seen in Figure 15. This suggests a prioritization for mitigating HACK-related vulnerabilities. This section reviews some suitable security controls that can mitigate these and other vectors. Such countermeasures could have reduced the likelihood and/or the impact of the breaches in the scope of this study. To improve overall security, companies may adopt a structured framework, such as the NIST Cybersecurity Framework (CSF), which is an agnostic framework categorizing several security controls in five cores, as shown in Table 7. These core categories provide an organized approach to improving cybersecurity measures. Especially for vulnerability mitigation, the Protect core function presents some valuable recommendations divided into categories: Identity Management, Authentication and Access Control, Awareness and Training, Maintenance, Protective Technology, Information Protection Processes and Procedures, and Data Security. \begin{table}
\begin{tabular}{l l l c} \hline \hline
**Act** & **State** & **Effect Date** & **\# (\%) Dataset Figure 2** \\ \hline CCPA & CA & 01/01/2020 & 79 (15.61\%) \\ CPRA & CA & 01/01/2023 & 79 (15.61\%) \\ VCDPA & VA & 01/01/2023 & 8 (1.58\%) \\ CPA & CO & 07/01/2023 & 2 (0.4\%) \\ CTDPA & CT & 07/01/2023 & 10 (1.98\%) \\ UCPA & UT & 12/31/2023 & 2 (0.4\%) \\ OCPA & OR & 07/01/2024 & 5 (0.99\%) \\ TDPSA & TX & 01/01/2024 & 30 (5.93\%) \\ FDBR & FL & 07/01/2024 & 19 (3.75\%) \\ MTCDPA & MT & 10/01/2024 & 0 (0\%) \\ ICDPA & IA & 01/01/2025 & 1 (0.2\%) \\ DPDPA & DE & 01/01/2025 & 3 (0.59\%) \\ TIPA & TN & 07/01/2025 & 3 (0.59\%) \\ Indiana CDPA & IN & 01/01/2026 & 8 (1.58\%) \\ \hline \hline \end{tabular}
\end{table} 
Table 6: State comprehensive data protection Acts and their applicability to the breaches in the dataset by type of data. None of these Acts were in effect in the dataset time range. The latter, more pertinent to this study, is then divided into subcategories, which are as follows: data at rest are protected; data in transit are protected; assets are formally managed throughout removal, transfers, and disposition; adequate capacity to ensure availability is maintained; integrity-checking mechanisms are used to verify software, firmware, and information integrity; the development and testing environments are separate from the production environment; integrity-checking mechanisms are used to verify hardware integrity; and protections against data leaks are implemented. Once again, the latter subcategory is more relevant to this work, and the NIST CSF references the Center for Internet Security (CIS) Critical Security Control, COBIT 5, ISA 62443-3-3:2013, ISO/IEC 27001:2013, and NIST SP 800-53 [59; 60; 61].