compliance

CCPA/CPRA and the US patchwork

Threshold-based applicability (revenue / records volume — verify current numbers); rights: know, delete, correct, opt-out of sale/share (GPC signal honored); "sale" is defined disturbingly broadly (adtech data flows count). The CPPA (CalPrivacy) regulations in force since 1 January 2026 add ADMT duties (comply by 1 January 2027), risk assessments (attestations due from April 2028), and cybersecurity audits (certifications phased April 2028–2030 by revenue). US state laws multiply yearly — websearch the map when a US audience matters.

SOC 2 readiness

• Type I = design at a point in time; Type II = operating effectiveness over 3–12 months — customers increasingly accept only Type II; the observation window means starting the habits now.
• Security (common criteria) is mandatory; add Availability/Confidentiality only if customers demand them — each added criterion is added audit surface.
• The controls that fail most: offboarding (access revoked within 24h, with evidence), quarterly access reviews (documented, not "we looked"), change management (PRs + approvals as evidence), vendor review, tested backups, and an incident-response doc that's been exercised once.
• ISO/IEC 27001: only the 2022 edition is certifiable — the transition from 2013 ended 31 October 2025. Annex A has 93 controls in four themes; the Statement of Applicability justifies every inclusion and exclusion. SOC 2 evidence maps onto it, so build one control set and map both.
• Evidence discipline beats heroics: screenshots/exports collected monthly into an organized folder turn the audit from archaeology into paperwork.

EU security regimes and payments (as of 2026-10 — verify per case)

• NIS2: essential and important entities by sector and size; national transposition is uneven, so read the member-state law. Incidents: early warning 24h, notification 72h, final report one month. Management bodies are personally accountable.
• DORA (EU financial entities, applies since 17 January 2025): ICT risk framework, register of ICT third-party arrangements, resilience testing; major ICT incidents reported within 4h of classification and no later than 24h after awareness.
• Cyber Resilience Act: since 11 September 2026, manufacturers of products with digital elements report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform (24h early warning, 72h notification, final report); the rest applies from 11 December 2027.
• PCI DSS 4.0.1: all future-dated requirements became mandatory 31 March 2025 (payment-page script controls, MFA for all cardholder-data-environment access, targeted risk analyses).
• US public companies (SEC): Form 8-K Item 1.05 within four business days of determining an incident is material; annual cyber risk-management and governance disclosure in the 10-K.

Questionnaires and policies

Answer what's true today; "No, planned for Q3" beats a yes that a breach later disproves — misrepresentation in a questionnaire is contract fraud territory. Policies state what you actually do, dated, owned, review-scheduled; copying a competitor's policy imports their practices as your promises.