There are some basic measures I did not know about until recently and had to make some changes. Some call this domain hijacking and can be a mess to try to get it back. A domain can be taken if it is not locked.
You must go into your control panel of your website to find the domain locking area. If it cannot be found you must contact your support. When your domain is locked, you’ll be substantially protected from unauthorized third parties who might try to misdirect your name servers or transfer your domain without your permission.
Overlooking domain names is icann.org and the rules of this are there. The FAQ section has a good start with internal links about transfers. They have the updated legal and technical requirements about transfer notification requirements and times.