nforcement authority, ???covered entities and other organizations are well-served to have a formal data security compliance program in place so that, should the FTC investigate a breach, they will be able to demonstrate that they have taken a reasonable approach to securing consumer data,??? Hirsch concluded.