California Privacy Law Assessment (CCPA/CPRA)
Comprehensive evaluation of your organization's compliance with California's privacy regulations, including the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). Our assessment examines data handling practices, consumer rights processes, and disclosure requirements to identify compliance gaps and provide a detailed remediation roadmap.
In scope
- CCPA/CPRA applicability assessment
- Personal information inventory
- Consumer rights implementation review
- Privacy notice evaluation
- Do Not Sell implementation assessment
- Sensitive personal information handling
- Data retention practices
- Service provider agreement review
- Employee data handling assessment
- Consumer request process evaluation
- Privacy policy review
- Risk assessment methodology
You receive
- California privacy compliance report
- Applicability determination
- Data inventory and mapping
- Consumer rights procedure recommendations
- Notice requirements implementation plan
- Privacy disclosure updates
- Vendor management framework
- Data retention guidelines
- Implementation roadmap and timeline
- Compliance monitoring strategy
Tiers
Choose the depth.
Essential California Privacy Assessment
$35K
CCPA/CPRA applicability determination and gap assessment for up to 250 employees: personal information inventory of up to 15 systems, privacy notice and policy review, consumer request process check, up to 10 service provider agreements.
- employees
- 250
- vendors
- 10
- frameworks
- 1
- Up to 250 employees, up to 15 systems inventoried
- Applicability determination
- Privacy notice and policy review
- Review of up to 10 service provider agreements
- Compliance report and roadmap
- — Drafting updated notices and procedures
- — Consumer rights procedure build-out
- — Data retention schedule
- — Other privacy frameworks
Comprehensive California Privacy Program
$60K
CCPA/CPRA assessment for up to 1,000 employees: data mapping of up to 40 systems, up to 25 service provider agreements, plus drafted privacy disclosures, consumer rights procedures, retention guidelines and vendor management framework.
- employees
- 1000
- vendors
- 25
- frameworks
- 1
- Up to 1,000 employees, up to 40 systems mapped
- Review of up to 25 service provider agreements
- Drafted notices and privacy disclosures
- Consumer rights request procedures
- Data retention guidelines and vendor framework
- — Hands-on implementation in your systems
- — Integration with other privacy frameworks
- — Post-project compliance maintenance
Enterprise California Compliance Framework
$95K
Advanced compliance program for complex organizations with custom implementation support, integration with other privacy frameworks, and ongoing compliance maintenance
- vendors
- 50
- frameworks
- 3
- — Legal representation or regulator filings
- — Privacy tooling licences
Members: engagement coupons from the CISO Marketplace coupon book apply to services. There is no blanket discount.
What's inside this engagement
Phase by phase.
How a readiness & governance assessment engagement runs, what happens in each phase and what you see. Exact scope, tier and timeline are fixed in your proposal and SOW.
01Scoping & framework selection
The standard or regulation, the systems and the business units in scope are fixed.
You see · Your audit or regulatory driver.
02Evidence collection & interviews
Policies, configurations and records reviewed; control owners interviewed.
You see · Documents and time with control owners.
03Gap analysis
Each requirement mapped to current state: met, partial or missing, with the evidence behind it.
You see · A clear gap register.
04Roadmap & evidence plan
Prioritized remediation with owners, and the evidence an auditor will ask for.
You see · A plan you can execute or hand to us.
Commercials
From first call to final report.
- 01
Scoping call
A practitioner, not a salesperson, walks through targets, constraints and what a good outcome looks like for you.
- 02
Proposal & rules of engagement
A fixed-scope proposal with tier, price and deliverables. Rules of engagement, contacts and out-of-bounds systems are agreed in writing.
- 03
Sign, then start
MSA and SOW are signed electronically and the deposit is paid. Only then does testing begin.
- 04
Execution
Testing runs to the agreed plan. Critical findings are escalated as they are found; you don't wait for the report.
- 05
Report & debrief
An executive summary plus technical findings with evidence, reproduction steps and fixes, walked through with your team.
- 06
Retest
Where the tier includes it, we verify your fixes and reissue the report, so auditors and customers see the issues closed.
Timelines are set per engagement in the SOW.
Related
Continuous Attack Surface Monitoring
Comprehensive continuous monitoring of your external attack surface with regular assessments and testing.
Active Directory Security Assessment
Comprehensive security assessment of Active Directory infrastructure, focusing on privilege escalation, lateral movement, and domain compromise scenarios.
Business Continuity Planning Assessment
Comprehensive evaluation of your organization's business continuity capabilities and operational resilience through detailed Business Impact Analysis (BIA), risk assessment, and continuity planning. Our specialized approach combines regulatory compliance requirements with practical business resilience strategies to ensure your organization can maintain critical operations during disruptions and recover effectively from various business interruption scenarios.
Research
Latest from the blog
compliance · Aug 26, 2026
€825 Million for an Algorithm: The Uber Fine Is the First Real Price Tag on Automated Decision-Making
On August 21, 2026, the Dutch DPA fined Uber €824.99 million — the second-largest GDPR penalty ever — not for a breach, not for a transfer mechanism, but for Article 22: automated decisions made about people without meaningful human involvement. Every organization deploying agents that act on humans just got a valuation. Here is what the decision actually requires.
ecosystem · Jul 15, 2026
Hardware Trust, From the SOC to the Board: A Role-by-Role Reading Guide to Our Network's Privacy-Hardware Series
Thirteen network pieces on one thesis — verifiable beats claimed — organized by role, from CISO budget owner to the analyst you're trying to hire.
ecosystem · Jul 14, 2026
One Storefront, Two Channels: How We Made Privacy Hardware Actually Procurable — US Warehouse or Direct from the EU
The privacy-hardware recommendation always died in the same place: a procurement team staring at an EU webshop with international shipping and no net-30. Here's how the securitygadgets.shop channel works alongside buying direct from Nitrokey and NovaCustom — US warehouse, PO terms, DEF CON-week Vegas pickup — and which path fits which buyer.
Start an engagement