Alexander Sultan

Excited to share an article co-authored with Colleen M. Yushchak on the upcoming CCPA regulations, featuring comprehensive cyber audit requirements, including data maps and retention schedules. With the intricacies involved, our clients are proactively beginning their planning to implement these new regulations. Preparing for CCPA’s Article 9: Data Maps, Retention Schedules, and Cyber Audit Obligations On May 1, 2025, the California Privacy Protection Agency (CPPA) released updated California Consumer Privacy Act (CCPA) Regulations, emphasizing privacy impact assessments (“risk assessments”), cybersecurity audits, and automated decision-making (“May 2025 Proposed Regulations”). In our prior article, we outlined the need for organizations to begin planning and budgeting in Q3 2025 to meet the significant, long-lead-time requirements. This article aims to thoroughly explore Article 9 of the May 2025 proposed regulations titled “Cybersecurity Audits.” Article 9: Cybersecurity Audits Under the proposed Article 9, organizations with over $100 million in revenue must complete their first cybersecurity audit report by April 2028. Organizations with between $50 million and $100 million in revenue must complete their first cybersecurity audit report by April 2029, while organizations with less than $50 million in revenue must do so by April 2030. Section 7123 of the May 2025 proposed regulations, “Scope of Cybersecurity Audit and Audit Report,” outlines the areas that the audit must consider. Many of the focus areas align with the National Institute of Standards and Technology Cybersecurity Framework 2.0 (NIST CSF), such as authentication, encryption, access management, secure configuration, internal and external vulnerability scans, network monitoring, data loss prevention, training, and incident response management. Below, we have highlighted certain requirements that organizations will need to focus on, which might be incremental to their existing cybersecurity program: Data map and data inventory – “Personal Information Inventories (e.g., maps and flows identifying where personal information is stored and how it can be accessed) and the classification and tagging of personal information.” Records retention schedules –“Retention schedules and proper disposal of personal information no longer required to be retained, by (1) shredding, (2) erasing, or (3) otherwise modifying the personal information in those records to make it unreadable or undecipherable through any means.” Remediation plan –“Document the business’s plan to address the gaps and weaknesses identified [in the audit report], including the resources it has allocated to resolve them and the timeframe in which it will resolve them. Written certification – “The written certification must be completed and submitted to... Click the link below to read the full article https://lnkd.in/gkC97bYa

32

I'm excited to share our latest article on preparing for CCPAs Article 9: "Data Maps, Retention Schedules, and Cyber Audit Optimization." In today's digital age, data privacy and protection have become more critical than ever. With the California Consumer Privacy Act (CCPA) evolving, businesses must adapt to ensure compliance and safeguard consumer information. This article delves into the intricacies of Article 9, focusing on the importance of data maps, effective data retention schedules, and optimizing cyber audits. 🔍 Key Insights: 1) Understanding the role of data maps in identifying and categorizing personal data. 2) Developing robust data retention schedules to maintain compliance and minimize risks. 3) Enhancing your organization's cyber audit processes to detect vulnerabilities and protect data integrity. Whether you're a compliance officer, data manager, or business leader, these insights are crucial to navigating the complexities of CCPA and ensuring your organization is prepared for the challenges ahead. Thanks to David Manek, CPA, CIPP, CIPM, AIGP for the insights! Check out the full article below. https://lnkd.in/eahKZS5G

30

1 Comment

Cyber risk isn’t just an IT issue—it’s a top strategic risk, according to Protiviti's most recent 2026 Top Risks Survey. Cybersecurity was rated as the top investment area for 43% of respondents in this year's survey. With AI and third-party ecosystems expanding the attack surface, organizations must move beyond qualitative heat maps and best guesses to use Cyber Risk Quantification (CRQ) to make the most of limited resources. Check out our blog on the FAIR Institute blog, published today by Sameer Ansari and me! #CRQ #riskmanagement #cyberrisk #FAIR https://lnkd.in/ew-Sr-E5

19

I recently shared Deloitte’s research on the evolving #CISO role and how it has become more strategic in recent years. As the CISO role evolves, so do the skills needed to be successful. Traditionally, the CISO career path follows an IT or technical background. Love this feature on two CISOs who didn’t follow the standard trajectory, including Deloitte’s global CISO Kevin Winter. Kevin has a degree in psychology and joined the Marine Corps. after college, where he learned both technical and leadership skills. As organizations broaden their view of cyber across the business, we’re seeing demand for people with a non-traditional skillsets (teaching, business and military backgrounds, for example) which translate to cybersecurity and add a lot of value. https://lnkd.in/enkv_65U

121

1 Comment

The SEC’s new cybersecurity disclosure rule is here, and it’s a big change for public companies. Adopted in July 2023, the rule requires registrants to: Promptly disclose material cybersecurity incidents Share risk management strategies and governance policies Outline processes for assessing and managing cyber threats in annual reports For companies, compliance means more than checking a box. It calls for clear documentation, gap assessments, framework alignment, and strong communication across the organization. Cybersecurity isn’t just a technical issue anymore; it’s a governance one. #Cybersecurity #RiskManagement #Governance #SECRule

18

We’ve got a great new episode of The Identity at the Center Podcast for you. We continue with part 3 of our series with RSM US LLP on the intersection of Cyber Security with Digital Identity. Kia M. Smith, MPP, CISA, CCFSP,PMP joined us to talk about the role of compliance and governance in digital identity and why they are so crucial to making sure the right people have the right access and that you can prove it. We learned a lot from Kia, so be sure to check it out. The episode is available now in your favorite podcast app and on YouTube at https://lnkd.in/eMKrB4DH #iam #podcast #idac

31

1 Comment

Heads up, NIST has released draft updates to its Interagency Report (8286 series). The updates were to align the ERM guidance more closely with NIST CSF 2.0 and to put a greater emphasis on cybersecurity governance. I think this could become a good foundation as a lot of companies still have ERM and cybersecurity working in silos and not in collaborative manner. Furthermore, we've seen quite a few articles stating how important a truly defined and transparent governance structure is invaluable to companies. Hopefully this can become a catalyst for companies to modernize/update their ERM structure and have proper oversight in their ERM programs.

29

1 Comment

Matthew W. Doherty, from our Workforce Risk Management team, talks about Digital Threat Assessments (DTA) in a recent article. These assessments, though once an afterthought, are becoming increasingly indispensable for organizations as they safeguard their digital footprint. By analyzing open-source intelligence, social media activity and exposed personal identifiable information (PII), DTAs provide a comprehensive evaluation of potential threats, helping businesses mitigate risks before they escalate into security incidents. This proactive approach helps enhance the safety and security of businesses. But, where do you start? I invite you to read our latest insight to learn more about what businesses can do to understand their digital exposure and help protect their organization from threats. https://lnkd.in/eewYMSUe

28

Own the Risk. Dominate the Future AI Risk Frameworks That Empower Growth and Guard Against Threats.   I was thrilled to find my article "Proven Strategies to Uncover AI Risks and Strengthen Audits" featured on the ISACA Journal. AI: The shiny new toy revolutionizing industries. Except, it's not all glitter and rainbows. For every breakthrough in automation or predictive analytics, there's a hidden minefield of risks lurking beneath the surface. Biases, security flaws, and an unsettling lack of transparency can all lead to costly missteps, especially when AI starts making critical business decisions. How do you manage the magic? How do you ensure that your organization isn't just riding the AI wave but surfing it safely? In this article, I'll guide you through the maze of AI risks and share battle-tested strategies to integrate them into your audit framework. After two decades of diving headfirst into cyber risks and mitigation strategies, I've seen first-hand how a well-prepared audit function can be the difference between staying ahead of the curve and getting blindsided by unforeseen challenges. Think of AI governance as your guardrail, but you must build it before you leap. That's where James Kavanagh comes in to help. His "Doing AI Governance" is a masterpiece. Dig deep, the diamonds are hidden there. Let's break down how to turn AI's unpredictable nature into a manageable asset. From mapping your AI ecosystem to monitoring data integrity and establishing rock-solid security measures, I'll walk you through the tools and frameworks you need to ensure your AI journey is as smooth as it is innovative. While AI might be the future, the path to making it safe, ethical, and auditable starts today. I am grateful to Jay Schwab and the ISACA Editorial team. #ISACA #InternalAudit #DigitalRisk #Resilience #StrategicAudit #AuditInnovation #AI #Governance #AICompliance #TechRisk #EugeneZonda #RiskManagement #BusinessTransformation #AuditLeadership https://lnkd.in/eSWGGYhA

41

📣New #bipartisan #legislation introduced in #Congress—the Healthcare Cybersecurity Act—aims to strengthen protection of #patientdata by enhancing collaboration between #HHS and #CISA. As #healthcare remains one of the most targeted sectors, this bill signals a growing recognition of #cybersecurity as critical to #patientsafety and national #resilience. https://lnkd.in/gruS7Krq

21