California’s cybersecurity audit rule is now in effect: its impact for class litigation

The California Privacy Protection Agency adopted a rule effective Jan 1, 2026 requiring covered businesses to complete and annually certify a cybersecurity audit addressing eighteen technical and organizational controls; the report highlights substantial compliance complexity and warns that these audits will likely become focal evidence in data-breach litigation.