Is Your Cyber Risk Assessment Legally Compliant? New York and California Are Raising the Bar

Over the past few years, regulators have increasingly prioritized cybersecurity, and two of the most influential regulators — the New York State Department of Financial Services (NYDFS) and the California Privacy Protection Agency (CPPA) — have led on the US state level. Both the CPPA and NYDFS now prescribe requirements for organizations’ cybersecurity programs. Most organizations have a baseline cybersecurity program, and many conduct some form of risk assessment or cybersecurity audit. Far fewer have explored whether their programs would withstand scrutiny under these regulatory frameworks. If your organization is subject to either regime or treats its requirements as the benchmark, now is the time to take a hard look to ensure compliance.

California: Mandatory Cybersecurity Audits Are Coming Online

Regulations under the CCPA now require covered businesses to complete an annual, independent cybersecurity audit — the first requirement of its kind among comprehensive US state data protection laws. Unlike the NYDFS regulations (which apply more narrowly to certain covered financial institutions, as discussed below), the CCPA audit requirement is sector-agnostic and applies to all organizations that conduct business in California and, in the prior calendar year, either:

1. Had annual gross revenue above the CCPA’s $26,625,000 revenue threshold and (i) processed the personal information of 250,000 or more California consumers or households, or (ii) processed the sensitive personal information of 50,000 or more consumers; or
2. Derived at least 50% of their annual revenue from selling or sharing the personal information of Californian residents.

Because the CCPA is sector-agnostic and extends its protections to employee and business contact data, companies outside of regulated industries and/or with little consumer-facing activity may also need to consider compliance with these obligations if they meet the applicable threshold requirements.

The CCPA’s cybersecurity audit requirements are prescriptive: the auditor must meet strict independence rules; the audit must assess each of the eighteen enumerated control areas applicable to the business; and an executive must certify completion to the CPPA under penalty of perjury. The obligations phase in by revenue: for businesses with 2026 annual gross revenue over $100 million, the first audit period opens January 1, 2027, and the first audit report is due April 1, 2028, with later phases for companies below this revenue threshold.

Companies subject to the CCPA may not yet have sufficient awareness of or readiness to meet these requirements. The eighteen control areas cover both technical and nontechnical safeguards and may also inform the CCPA’s working definition of “reasonable security” in breach litigation under the CCPA’s limited private right of action.

Although businesses do not need to file the report directly with the CPPA, they must retain it for five years. These reports must describe in detail any gaps the auditor identified, as well as the business’s plan and timeline for addressing them. Accordingly, the reports create risk because they require covered companies to maintain a roadmap of their own security weaknesses that regulators, plaintiffs, and potentially even threat actors could obtain.

For more detail on these eighteen control areas, please see Goodwin’s alert titled “California’s New Privacy and Cybersecurity Regulations on Risk Assessments, Automated Decision-Making, and Cybersecurity Audits: What Businesses Need to Know.”

New York: NYDFS “Clarifies” Requirements for Cybersecurity Risk Assessments

On the other coast, NYDFS recently issued new guidance to regulated entities on cybersecurity risk assessments under its Cybersecurity Regulation, 23 NYCRR Part 500. NYDFS’s Industry Letter dated September 10, 2026, states that its guidance creates no new obligations but instead is intended to “clarify regulatory requirements and highlight best practices” in conducting risk assessments. The points emphasized in the guidance, summarized below, are drawn from deficiencies NYDFS examiners have identified when reviewing certain companies’ risk assessments and are expected to serve as a playbook for future examinations.

• Scope. Complete asset inventories, visibility into where nonpublic information resides and flows, and coverage of third-party and cloud dependencies.
• Methodology. Consistent rating criteria, testing of whether controls actually work, and a documented distinction between inherent and residual risk.
• Emerging and concentration risk. Consideration of artificial intelligence, quantum computing, supply chain and ransomware threats, and single points of failure across shared vendors.
• Traceability and governance. A documented line from each identified risk to the control or risk acceptance decision that addresses it, with results reaching senior management and the board.
• Updates. A refresh at least annually and whenever cyber risk materially changes, such as after a major system migration, an acquisition, significant outsourcing, or adoption of frontier AI models.

The timing matters: Covered entities must certify their compliance with Part 500 to NYDFS each April 15, and they may struggle to certify compliance based on a risk assessment that the department has already described as deficient. Entities currently under examination or that are remediating systems and processes after a cyber incident should expect the department to hold them to the guidance.

Comparing the CCPA and NYDFS Requirements

Although the CCPA “audit” and NYDFS “assessment” requirements have many parallels, the two frameworks have notable differences.

• NYDFS’s guidance and regulation contain more prescriptive, universal multi-factor authentication requirements than the CCPA’s audit requirements;
• The CCPA requires assessment of data inventories of personal information and sensitive personal information, mapped to CCPA definitions, as well as hardware and software inventories;
• The CCPA implements a contractual audit cooperation requirement for vendors that have access to the personal information of California residents; and
• The CCPA mandates that covered companies assess their vulnerability disclosure programs.

Accordingly, existing audit work under either framework, or under voluntary frameworks such as SOC 2 or NIST 2.0, can support compliance with these audit requirements but may not suffice on its own. For example, under the CCPA audit requirements, a business may rely on an audit prepared for another purpose only if the audit meets every requirement of the California rules. Common gaps include self-defined scopes, reports that omit remediation timelines, and assessors who also advise on the program.

Why This Matters

Together, these developments pair new guidance under the mature Part 500 regime, which has been in effect since 2017, with a new and untested regime. Organizations that are directly subject to either regulation have a clear compliance mandate, but for everyone else, the two regimes offer the clearest signals yet of what regulators, plaintiffs, and courts are likely to consider a best-in-class cybersecurity program. A cybersecurity risk assessment or program development approach that was developed before these changes may no longer measure up.

Practical first steps:

• Businesses that may meet the CCPA thresholds. Complete the scoping analysis now, confirm the auditor’s independence, and separate any advisory engagement from the audit.
• NYDFS-regulated entities. Benchmark the current risk assessment against the guidance before the next certification or examination.
• Everyone else. Treat the two regimes as the benchmark for the next review of your program.

A final note of caution: a company’s internal analysis of its compliance readiness (and apparent gaps) should be conducted carefully and, ideally, under attorney-client privilege and at the direction of internal or external counsel. Doing so will not only help calibrate changes to existing processes but also help avoid the creation of documentation that could be leveraged by adverse parties in litigation or by regulators in an enforcement inquiry.

Goodwin’s cybersecurity, data privacy, and financial services experts can help you assess whether and how these requirements apply to your organization and where your program stands. Please contact the authors or your Goodwin relationship attorney to learn more.