From Panic to Preparedness: California’s New Cyber Audit Regulations
summary
Draft California regs require an annual, board‑reported cybersecurity audit covering 18 components (encryption, access controls, vendor management, incident response and more), with auditors independent and evidence kept five years. Regulators signal likely finalization around July and give two years total — effectively one year to ready and one to conduct audits. Notable specificity includes zero trust architecture listed by name and allowance for documented compensating controls when a component is absent.
AI-written summary · about
chapters (14)
- 0:00California’s new cyber audit rules
- 4:03Legal background of CCPA audits
- 11:17Differences from past cybersecurity laws
- 20:13Readiness timelines and enforcement
- 23:23Scoping and executing cybersecurity audits
- 32:35Readiness program and integration
- 36:36Key takeaways and next steps
- 36:56Q&A: Public access to reports
- 37:38Q&A: Employee data scope
- 38:22Q&A: Revenue and geographic calculations
- 39:06Q&A: Vendor management
- 41:18Q&A: Children’s personal information
- 43:27Q&A: Business contact information
- 44:35Q&A: GLBA vs CCPA standards
related talks
51mDo Better: Board-Level Accountability in Cybersecurity
42mPreparing for the New Era of Cybersecurity Disclosure
27m4 Panel Session - Bridging Policy and Practice
44mPanel Discussion: Prepare for the CRA: Open Source Governance in the Age of Cyber Resilience
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
16mCyber Resilience Act, already too late to comply?
40mHow the Identity Portions of CCPA Regs Put Consumers and Businesses at Risk
29mManaging Privacy and Cyber In A Pandemic: Lessons Learned For 2021 & Beyond