Businesses have to follow cyber laws like GDPR and HIPAA. They also need plans in case they’re attacked. And they must manage risks well to keep their digital stuff secure.