There's a very familiar phrase in the cybersecurity world that is rapidly becoming of critical importance to lawyers as well. You can be cyber-compliant and not be cyber-secure. You can be cyber-secure and not be cyber-compliant.

The first half of that equation should be pretty self-evident to everyone. Anyone, including lawyers in the United States, can be fully compliant with every single type of regulation and law that attempts to protect personal or private data, and it can still leak out and be seen by unauthorized persons.

It's the second half of that equation that can surprise people. How is it possible that a computer system can be so well locked-down that no hacker can successfully gain access, and yet the entity in charge of protecting that data be considered out-of-compliance?