Call us now:
Thank you, James Dempsey, for highlighting the legislative changes adopted by California on Risk Assessments, Cybersecurity, Automated Decision-making systems, and audit.
In one’s opinion, the regulation is a significant development for cybersecurity risk management oversight and assurance. California is often referred to as one of the world’s largest economies, overtaking Japan (IMF), which attracts large sums of investment and is globally recognised for economic development, innovation, and an estimated nominal GDP of over $4trn (IMF). Therefore, its regulatory approach attracts attention. Why rock the boat if things are working well?
In this case, the regulation focuses on Cybersecurity, Risk Assessment, Automated Decision Making Systems (Let’s call that AI), and cybersecurity Audit. A regulation that is industry agnostic and for cybersecurity requires covered companies to submit annual audits of their cybersecurity risk, incidents, and is one of the few regulations globally that is specific about the cybersecurity controls an audit must address.
While the regulation is posted under the Personal Data Protection banner, it goes much further. Regulations such as GDPR are not control-specific; they do not require an organization to demonstrate proactive management of risk via an annual audit submission. The rule from California does. It also requires the evaluation of the risk of automated decision-making tools using AKA AI. The regulation is also sector agnostic, meaning if you are in scope of the management of personal data, the regulation will apply to you (balance sheet dependent).
@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan
Veritas GRC
#cybersecurity #cyberaudit
https://lnkd.in/efMdiB6F
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7374705488447557632