California’s new CCPA regulations from the California Privacy Protection Agency move privacy from paperwork to proof. This session unpacks the CPPA’s Cybersecurity Audits (Article 9), Risk Assessments (Article 10), and Automated Decision-Making Technology governance (Article 11), with cross-references to state data-protection assessment laws and standards from NIST (including SP 800-53) and the International Standardization Organization (ISO).
This presentation shows how to build a CPPA-ready vendor management program that prioritizes proof over paper. It translates legal requirements into a practical assessment workflow with risk scoring, continuous monitoring, and enforceable contract controls. And beyond CPPA, it shows how the same evidence framework scales across jurisdictions and standards, supports board and executive reporting, and strengthens diligence and defensibility for any high-stakes vendor ecosystem.
Who the regulations impact: Any business processing California personal information, plus their service providers; however, other states are tracking the same path
Who this presentation is for: In-house and outside counsel advising on privacy, contracts, product, M&A, or litigation
Why attend: Learn what the rules demand and how to implement them so as to comply with audits, assessments, ADMT notices and safeguards, vendor oversight, and board reporting
- Opening & Objectives
- What CPPA expects, what “proof over paper” means, and how the assessment form turns legal rules into verifiable vendor controls
- CPPA Rule Changes & Why They Matter
- New ADMT, risk review, and audit requirements, and how those create mandatory checkpoints for vendor oversight across jurisdictions
- Evidence-Based Vendor Management Framework
- The three pillars — clear rules, realistic controls, documented proof — and how the Keystone Pro assessment operationalizes them
- Risk Scoring & Continuous Monitoring
- How importance, probability, impact, and controls produce ranked fixes, plus trigger events, change logs, and the compliance loop
- Contracting for Accountability
- Translating assessment findings into audit rights, performance standards, sub-vendor controls, and integrated documentation
- Standards Mapping & Executive Reporting
- Using the same evidence to brief leadership and boards, mapped to NIST, ISO, and IEEE for defensibility and clarity
- Governance & Defensibility Under Scrutiny
- Vendor Risk Committee structures, minutes and attachments, privilege strategy, and showing decisions were reasonable at the time
- Close: Key Takeaways
- Rules, controls, proof, and the goal of eliminating the “how did you not know this” problem
- Questions & Answers (as time permits)
Free Justia Connect Memberships are available to lawyers, other legal professionals, students, and all law enthusiasts.
Log In NowNot a Member? Get Connected for Free
* CLE credit is only available to Justia Connect Pro members.
Maslon LLP
Eran Kahana is an AI, cybersecurity, and intellectual property lawyer as well as a Fellow at Stanford Law School, a member of the Advisory Board of Stanford Law School’s Stanford Artificial Intelligence & Law Society, and an Adjunct Professor of Law at the University of Minnesota Law School. Read More ›
*CLE credit is only available to Justia Connect Pros. Not a Pro? Upgrade today>>
Status: Approved
Credits: 1.00 General
Status: Approved
Credits: 1.20 General
Status: Approved
Credits: 1.00 General
Status: Approved
Credits: 1.00 General
Difficulty: All Levels
Status: Approved
Credits: 1.00 General
This presentation is approved for one hour of General CLE credit in California, North Carolina, and South Carolina (all levels). This program has been approved by the Board on Continuing Legal Education of the Supreme Court of New Jersey for 1.20 hours of total CLE credit. This course has been approved for Minimum Continuing Legal Education credit by the State Bar of Texas Committee on MCLE in the amount of 1.00 credit hours.
Justia only reports attendance in jurisdictions in which a particular Justia CLE Webinar is officially accredited. Lawyers may need to self-submit their certificates for CLE credit in jurisdictions not listed above.
Note that CLE credit, including partial credit, cannot be earned outside of the relevant accreditation period. To earn credit for a course, a lawyer must watch the entire course within the relevant accreditation period. Lawyers who have viewed a presentation multiple times may not be able to claim credit in their jurisdiction more than once. Justia reserves the right, at its discretion, to grant an attendee partial or no credit, in accordance with viewing duration and other methods of verifying course completion.
At this time, Justia only offers CLE courses officially accredited in certain states. Lawyers may generate a generic attendance certificate to self-submit credit in their own jurisdiction, but Justia does not guarantee that lawyers will receive their desired CLE credit through the self-submission or reciprocity process.