--- title: "California CPRA Risk Assessments, Cybersecurity Audits, and ADMT Guide" canonical_url: "https://www.sorena.io/artifacts/us/california-privacy-rights-act/risk-assessments-cybersecurity-audits-and-admt" source_url: "https://www.sorena.io/artifacts/us/california-privacy-rights-act/risk-assessments-cybersecurity-audits-and-admt" author: "Sorena AI" description: "California CPRA guidance for risk assessments, cybersecurity audits, and ADMT, with practical decisions, evidence, edge cases, and external source citations." published_at: "2026-05-09" updated_at: "2026-05-09" keywords: - "California CPRA" - "CPRA risk assessments" - "cybersecurity audits" - "automated decisionmaking technology" - "ADMT" - "compliance checklist" - "practical guidance" - "Risk Assessments" - "Compliance" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # California CPRA Risk Assessments, Cybersecurity Audits, and ADMT Guide California CPRA guidance for risk assessments, cybersecurity audits, and ADMT, with practical decisions, evidence, edge cases, and external source citations. *Artifact Guide* *US* *Risk Assessments Cybersecurity Audits And ADMT* ## US CPRA Risk Assessments Cybersecurity Audits And ADMT Risk Assessments Cybersecurity Audits And ADMT decisions under the US CPRA should be written in operational language: who is in scope, what must happen, what evidence proves it, and when escalation is needed. This page offers practical steps for implementation planning. Confirm legal and policy assumptions before implementation. Use this page to decide whether your business must complete a CPRA risk assessment, cybersecurity audit, or ADMT notice and opt-out process. It explains the main triggers, who has to act, and what evidence teams should keep. ## Who must follow the US CPRA risk assessment, cybersecurity audit, and ADMT rules? These rules can apply to businesses that sell or share personal information, process sensitive personal information for non-exempt purposes, use ADMT for a significant decision, or process consumers' personal information in a way that presents significant risk to privacy or security. The CPPA regulations page says the rulemaking covers businesses required to conduct risk assessments, complete annual cybersecurity audits, and implement consumers' rights to access and opt out of businesses' use of ADMT. - Risk assessments apply before a business starts processing that presents significant privacy risk, including selling or sharing personal information, processing sensitive personal information, using ADMT for a significant decision, and certain training or profiling uses. - Cybersecurity audits apply to businesses whose processing of consumers' personal information presents significant risk to consumers' security under section 7120. - ADMT obligations apply when a business uses ADMT to make a significant decision concerning a consumer, with notice, opt-out, access, and appeal rules depending on the use. - Teams should identify the business, processing activity, and trigger first, then route the work to privacy, legal, security, and product owners. Sources for this answer: - [CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations](https://cppa.ca.gov/regulations/ccpa_updates.html?ref=sorena.io) - The CPPA regulations page is the official rulemaking hub for CCPA updates covering cybersecurity audits, risk assessments, ADMT, and insurance regulations. - [CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations](https://cppa.ca.gov/regulations/ccpa_updates.html?ref=sorena.io) - The CPPA regulations page is the official rulemaking hub for CCPA updates covering cybersecurity audits, risk assessments, ADMT, and insurance regulations. - [California Privacy Protection Agency FAQ](https://cppa.ca.gov/faq.html?ref=sorena.io) - CPPA FAQ confirms CPRA added consumer privacy rights and business obligations, which frames the California privacy workflow. ## What fields should the Risk Assessments Cybersecurity Audits And ADMT template capture? A useful template captures business threshold, consumer/data category, request or signal type, vendor role, response deadline, notice/control evidence, and escalation reason. - Source URL and source quote. - Entity, product, service, system, data category, and user group. - Decision result, control action, owner, reviewer, due date, and escalation reason. - Evidence attachment, approval note, exception note, and review cadence. Sources for this answer: - [NIST SP 800-53A Rev. 5](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final?ref=sorena.io) - NIST SP 800-53A supports audit evidence planning by providing assessment procedures for security and privacy controls. - [California Privacy Protection Agency FAQ](https://cppa.ca.gov/faq.html?ref=sorena.io) - CPPA FAQ confirms CPRA added consumer privacy rights and business obligations, which frames the California privacy workflow. - [NIST SP 800-122](https://csrc.nist.gov/pubs/sp/800/122/final?ref=sorena.io) - Template field support for Risk Assessments Cybersecurity Audits And ADMT. ## How should teams review and improve the Risk Assessments Cybersecurity Audits And ADMT workflow? Review the workflow after CPPA rulemaking updates, ad-tech changes, vendor changes, new data categories, consumer complaints, enforcement advisories, or material product changes. - Track recurring exception categories and update intake questions. - Remove fields that never affect the decision. - Add fields when reviews show missing source evidence or unclear ownership. - Confirm public guidance, internal playbooks, and evidence records all point to the same source-linked CPRA decision. Sources for this answer: - [CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations](https://cppa.ca.gov/regulations/ccpa_updates.html?ref=sorena.io) - The CPPA regulations page is the official rulemaking hub for CCPA updates covering cybersecurity audits, risk assessments, ADMT, and insurance regulations. - [NIST SP 800-53A Rev. 5](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final?ref=sorena.io) - NIST SP 800-53A supports audit evidence planning by providing assessment procedures for security and privacy controls. - [California Privacy Protection Agency FAQ](https://cppa.ca.gov/faq.html?ref=sorena.io) - CPPA FAQ confirms CPRA added consumer privacy rights and business obligations, which frames the California privacy workflow. - [NIST SP 800-122](https://csrc.nist.gov/pubs/sp/800/122/final?ref=sorena.io) - Review support for Risk Assessments Cybersecurity Audits And ADMT. *Recommended next step* *Placement: after the practical guidance* ## Turn US CPRA Risk Assessments Cybersecurity Audits And ADMT into assigned work This US CPRA guide turns turn Risk Assessments Cybersecurity Audits And ADMT into owners, evidence requests, review checkpoints, and reusable operating records inside Sorena. - [Open Assessment Autopilot for US CPRA](/solutions/assessment.md): Turn Risk Assessments Cybersecurity Audits And ADMT into scoped questions, evidence fields, and review tasks. - [Review US CPRA source evidence](/solutions/research-copilot.md): Use Research Copilot to answer follow-up questions with cited source material. - [Talk through implementation](/contact.md): Review scope, evidence, owners, and the next compliance actions with Sorena. ## Primary sources - [CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations](https://cppa.ca.gov/regulations/ccpa_updates.html?ref=sorena.io) - The CPPA regulations page is the official rulemaking hub for CCPA updates covering cybersecurity audits, risk assessments, ADMT, and insurance regulations. - Quote: "Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations" - [NIST SP 800-53A Rev. 5](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final?ref=sorena.io) - NIST SP 800-53A supports audit evidence planning by providing assessment procedures for security and privacy controls. - Quote: "Assessing Security and Privacy Controls in Information Systems and Organizations" - [California Privacy Protection Agency FAQ](https://cppa.ca.gov/faq.html?ref=sorena.io) - CPPA FAQ confirms CPRA added consumer privacy rights and business obligations, which frames the California privacy workflow. - Quote: "The CPRA amended the CCPA by adding additional consumer privacy rights and obligations for businesses" - [NIST SP 800-122](https://csrc.nist.gov/pubs/sp/800/122/final?ref=sorena.io) - Supports Risk Assessments Cybersecurity Audits And ADMT under the US CPRA. - Quote: "PII should be protected from inappropriate access, use, and disclosure" - [NIST SP 800-53 Rev. 5](https://csrc.nist.gov/pubs/sp/800/53/r5/final?ref=sorena.io) - Supports Risk Assessments Cybersecurity Audits And ADMT under the US CPRA. - Quote: "The controls are flexible and customizable and implemented as part of an organization-wide process to manage risk" ## Related Topic Guides - [California CPRA Checklist](/artifacts/us/california-privacy-rights-act/checklist.md): Practical guidance for the California CPRA checklist, with practical decisions, evidence, edge cases, and external source citations. - [California CPRA FAQ](/artifacts/us/california-privacy-rights-act/faq.md): Practical California CPRA FAQ guidance with implementation decisions, evidence, edge cases, and official California source citations. - [California CPRA penalties and fines Guide](/artifacts/us/california-privacy-rights-act/penalties-and-fines.md): US CPRA guidance for penalties and fines, with practical decisions, evidence, edge cases, and external source citations. - [California CPRA Requirements Guide](/artifacts/us/california-privacy-rights-act/requirements.md): Practical guidance for California CPRA requirements, with practical decisions, evidence, edge cases, and external source citations. - [California Data Broker Deletion Workflow Guide](/artifacts/us/california-privacy-rights-act/data-broker-deletion-workflow.md): California Delete Act and CPRA-adjacent guidance for data broker deletion workflows, with practical decisions, evidence, edge cases, and official citations. - [California Data Broker Registry and DROP Guide](/artifacts/us/california-privacy-rights-act/data-broker-registry-and-drop.md): California Delete Act guide to the Data Broker Registry and DROP, with practical decisions, evidence, edge cases, and official source citations. - [California Delete Act data broker registry and DROP guide](/artifacts/us/california-privacy-rights-act/faq/data-broker-registry-and-drop.md): California Delete Act guidance for the data broker registry and Delete Request and Opt-Out Platform (DROP), with owners, evidence, and official sources. - [CPRA enforcement advisories: CPPA investigations, fines, and risk mitigation](/artifacts/us/california-privacy-rights-act/faq/enforcement-advisories.md): US CPRA guidance for Enforcement Advisories, with practical decisions, evidence, edge cases, and external source citations. - [CPRA Global Privacy Control (GPC): opt-out requirements and enforcement FAQ](/artifacts/us/california-privacy-rights-act/faq/gpc.md): US CPRA guidance for GPC, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Applicability Test Guide](/artifacts/us/california-privacy-rights-act/applicability-test.md): Practical guidance for the US CPRA applicability test, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA CCPA vs CPRA Guide](/artifacts/us/california-privacy-rights-act/ccpa-vs-cpra.md): US CPRA guidance for CCPA vs CPRA, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Compliance Guide](/artifacts/us/california-privacy-rights-act/compliance.md): Practical guidance for the US CPRA compliance, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Consumer Rights Workflow Guide](/artifacts/us/california-privacy-rights-act/consumer-rights-workflow.md): US CPRA guidance for Consumer Rights Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Contract Terms Guide](/artifacts/us/california-privacy-rights-act/contract-terms.md): US CPRA guidance for Contract Terms, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Contracts Contractors And Service Providers Guide](/artifacts/us/california-privacy-rights-act/contracts-contractors-and-service-providers.md): US CPRA guidance for Contracts Contractors And Service Providers, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Correction Rights Guide](/artifacts/us/california-privacy-rights-act/correction-rights.md): US CPRA guidance for Correction Rights, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Cppa Regulations Tracker Guide](/artifacts/us/california-privacy-rights-act/cppa-regulations-tracker.md): US CPRA guidance for Cppa Regulations Tracker, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Cyber Audit Readiness Workflow Guide](/artifacts/us/california-privacy-rights-act/cyber-audit-readiness-workflow.md): US CPRA guidance for Cyber Audit Readiness Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Deadlines and Compliance Calendar Guide](/artifacts/us/california-privacy-rights-act/deadlines-and-compliance-calendar.md): US CPRA guidance for Deadlines and Compliance Calendar, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA DSAR And Correction Workflow Guide](/artifacts/us/california-privacy-rights-act/dsar-and-correction-workflow.md): US CPRA guidance for DSAR And Correction Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA GPC Handling Guide](/artifacts/us/california-privacy-rights-act/gpc-handling.md): US CPRA guidance for GPC Handling, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA GPC Handling Workflow Guide](/artifacts/us/california-privacy-rights-act/gpc-handling-workflow.md): US CPRA guidance for GPC Handling Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Retention Guide](/artifacts/us/california-privacy-rights-act/retention.md): US CPRA guidance for Retention, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Risk Assessment Intake Workflow Guide](/artifacts/us/california-privacy-rights-act/risk-assessment-intake-workflow.md): US CPRA guidance for Risk Assessment Intake Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Risk Assessment Template Guide](/artifacts/us/california-privacy-rights-act/cpra-risk-assessment-template.md): US CPRA guidance for CPRA Risk Assessment Template, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Risk Assessments And Cybersecurity Audits Guide](/artifacts/us/california-privacy-rights-act/risk-assessments-and-cybersecurity-audits.md): US CPRA guidance for Risk Assessments And Cybersecurity Audits, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Sensitive Personal Information Guide](/artifacts/us/california-privacy-rights-act/sensitive-personal-information.md): US CPRA guidance for Sensitive Personal Information, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Sensitive Personal Information Limits Guide](/artifacts/us/california-privacy-rights-act/sensitive-personal-information-limits.md): US CPRA guidance for Sensitive Personal Information Limits, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Sharing and Cross-Context Behavioral Advertising Guide](/artifacts/us/california-privacy-rights-act/sharing-and-cross-context-behavioral-advertising.md): US CPRA guidance for Sharing and Cross-Context Behavioral Advertising, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA vs Colorado Privacy Act Guide](/artifacts/us/california-privacy-rights-act/cpra-vs-colorado-privacy-act.md): US CPRA guidance for CPRA vs Colorado Privacy Act, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA vs Virginia Vcdpa Guide](/artifacts/us/california-privacy-rights-act/cpra-vs-virginia-vcdpa.md): US CPRA guidance for CPRA vs Virginia Vcdpa, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about ADMT under the US CPRA?](/artifacts/us/california-privacy-rights-act/faq/admt.md): US CPRA guidance for ADMT, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Contract Terms under the US CPRA?](/artifacts/us/california-privacy-rights-act/faq/contract-terms.md): US CPRA guidance for Contract Terms, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Correction Rights under the US CPRA?](/artifacts/us/california-privacy-rights-act/faq/correction-rights.md): US CPRA guidance for Correction Rights, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Cybersecurity Audits under the US CPRA?](/artifacts/us/california-privacy-rights-act/faq/cybersecurity-audits.md): US CPRA guidance for Cybersecurity Audits, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about retention under the California CPRA?](/artifacts/us/california-privacy-rights-act/faq/retention.md): California CPRA guidance for retention, including data minimization, privacy policy disclosures, evidence records, and official source citations. - [What should teams do about Risk Assessments under the US CPRA?](/artifacts/us/california-privacy-rights-act/faq/risk-assessments.md): US CPRA guidance for Risk Assessments, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Sensitive Personal Information Limits under the US CPRA?](/artifacts/us/california-privacy-rights-act/faq/sensitive-personal-information-limits.md): US CPRA guidance for Sensitive Personal Information Limits, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Sharing and Cross-Context Behavioral Advertising under the California CPRA?](/artifacts/us/california-privacy-rights-act/faq/sharing-and-cross-context-behavioral-advertising.md): California CPRA guidance for Sharing and Cross-Context Behavioral Advertising, with practical decisions, evidence, edge cases, and external source citations. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/us/california-privacy-rights-act/risk-assessments-cybersecurity-audits-and-admt