Data breach prevention is a battle, rarely plain and never simple. For higher education institutions, the Sisyphean aspects of the task are more complex than for industry and business. Two-year colleges have payrolls and vendor contracts like those enterprises. They also have public record and student confidentiality requirements. Colleges must provide open academic environments for learning and accommodate a wide array of mobile phones, laptops, and thumb drives that students, faculty, staff and visitors use on campus and access remotely via college networks. Through his work as executive director and principal investigator of the National CyberWatch Center at Prince George's Community College, Casey W. O'Brien devised a data breach and protection strategy for college administrators that works in tandem with the National Institute of Standards and Technology (NIST) Framework. His four step plan is presented and explained in this article, along with one colleges journey, the Community College of Rhode Island (CCRI). The four step plan includes (1) Prioritize academic objectives and figure out the institution's risk tolerance; (2) Make sure the college has a proactive security plan; (3) Prepare for the inevitable: You are going to be attacked; and (4) Promote a culture of security within the college.