{
  "id": "10",
  "content": [
    {
      "type": "heading",
      "text": "Compliance & Policy (NIST, GDPR) + Education"
    },
    {
      "type": "text",
      "html": "Adopt NIST-aligned practices: resist breached passwords, rate limit, avoid mandatory frequent rotation, support MFA."
    },
    {
      "type": "text",
      "html": "<pre><code># .htaccess: security headers\n&lt;IfModule mod_headers.c&gt;\nHeader set X-Content-Type-Options \"nosniff\"\nHeader set X-Frame-Options \"SAMEORIGIN\"\nHeader set Referrer-Policy \"strict-origin-when-cross-origin\"\n&lt;/IfModule&gt;\n</code></pre>"
    },
    {
      "type": "text",
      "html": "Pair technical controls with user education: managers, unique passwords, phishing awareness, and safe recovery."
    }
  ],
  "quiz": {
    "questions": [
      {
        "id": "q1",
        "type": "single",
        "text": "Modern guidance recommends:",
        "options": [
          {
            "id": "a",
            "text": "Screen against breached lists"
          },
          {
            "id": "b",
            "text": "Frequent forced rotation for everyone"
          },
          {
            "id": "c",
            "text": "Allow 'password123'"
          }
        ],
        "correct": [
          "a"
        ]
      },
      {
        "id": "q2",
        "type": "single",
        "text": "Security that lasts requires:",
        "options": [
          {
            "id": "a",
            "text": "User education + good policy"
          },
          {
            "id": "b",
            "text": "Ignoring users"
          },
          {
            "id": "c",
            "text": "Only technical tools"
          }
        ],
        "correct": [
          "a"
        ]
      }
    ]
  }
}