A Potential Look Into The Future: California Issues First Draft Of Cybersecurity Audit And Risk Assessment Regulations

Introduction

The Board of the California Privacy Protection Agency (the CPPA) held its first meeting since July on Friday, September 8, 2023, and discussed the first public draft of cybersecurity audit regulations and risk assessment regulations.¹ While the CPPA Board expressly announced that the drafts were for board meeting discussion purposes and that it has not started the formal rulemaking procedures yet, the first public drafts of the regulations provide a roadmap for where the CPPA Board may go, and the draft regulations would impose new and detailed compliance requirements.

The CPPA Board determined that the draft regulations will be edited prior to the next meeting, which is likely to be held in December 2023, before the regulations enter into formal rulemaking procedures. However, the CPPA Board engaged in substantive discussions about the regulations that give an indication of what the finalized regulations may look like (subject to public comment). In