Reasonable security for US state privacy laws
California and a growing list of states require businesses to protect personal information with reasonable security and to notify people when it is breached. Ciyora helps you control who can reach personal information, notice when something goes wrong, and show what you did about it.
What the laws ask
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, requires a business that collects personal information to implement reasonable security procedures and practices appropriate to the nature of that information. A data breach caused by a failure to maintain reasonable security can lead to a private right of action, and since January 1, 2023 the law also covers the personal information of employees and job applicants. Regulations from the California Privacy Protection Agency add cybersecurity audit and risk assessment requirements for businesses whose processing presents significant risk.
Comprehensive privacy laws in states such as Virginia, Colorado, Connecticut and Texas also require controllers to maintain reasonable data security practices, and every state has a data breach notification law. Ciyora is a security platform, not a consent manager or a cookie banner. It helps with the security, breach readiness and accountability parts of these laws, including for the personal information your own security tools process about employees.
How Ciyora maps to the requirement areas
Each row names a control area, what Ciyora does for it, and the evidence it can produce. Your own policies, people and processes still matter: the platform helps you operate and evidence the controls.
| Requirement area | How Ciyora helps | Evidence you can produce | Modules |
|---|---|---|---|
| Reasonable security: access control | Least-privilege access to systems that hold personal information, with requests, approvals, reviews, just-in-time privilege and recorded privileged sessions. | Access reviews, privileged access reports and session recordings for systems holding personal information. | Fortress |
| Reasonable security: network and configuration | Zero-trust network access to data stores; cloud posture checks for public exposure, encryption and logging settings; data store discovery ranked by sensitivity and exposure. | Access policy history; posture findings such as publicly readable storage and their remediation. | VPN, Armor |
| Detecting a data breach | Detections for credential theft, unusual access and data exfiltration patterns; endpoint data-protection events for file transfers, USB devices and AI tools. | Alerts and incidents with the affected identities, assets and data noted. | Detect, Monitor |
| Breach response and notification | Incident timelines that record when a breach was detected, who handled it and what was done, to support the notifications that state breach laws require. | Incident timelines and response records. | Detect |
| Consumer requests | Requests to know, delete or correct tracked from intake to closure, with consent records that can be revoked. | Request status history and consent records. | Comply |
| Retention and data minimization | Retention periods per data type in Ciyora settings, including monitoring data such as screenshots, so security data about people is not kept longer than needed. | Retention settings and their change history. | Comply, Monitor |
| Knowing where personal information lives | Inventory of assets, SaaS applications and cloud resources, with sensitivity and who has access. | Asset and SaaS inventories with access lists. | Discover, Fortress |
| Cybersecurity audits and risk assessments | Controls, risks and policies in one place, with posture history and a hash-chained audit log of administrative actions, approvals and access decisions. | Posture snapshots, the risk register, audit exports and chain verification. | Comply |
Your security tools process personal information too
Endpoint monitoring and identity governance involve personal information about employees and contractors, and states such as New York, Connecticut and Delaware require employers to give notice of electronic monitoring. Ciyora Monitor is built for transparent monitoring: employee notices, acknowledgements and audit trails are built in, and each employee can see what is collected about them. Organizations configure monitoring under their own legal obligations; the lawful purpose and the policy remain your decisions. How Ciyora Monitor handles privacy.
Please note. Ciyora is not a certification and does not make an organization compliant on its own. This page describes how Ciyora capabilities map to requirement areas and help you produce evidence. Always read the current text of the regulation or standard and take advice from your compliance team, auditors or legal counsel.
Walk through your control set with us
Bring your latest audit observations or gap assessment, and we will show where Ciyora fits and where it does not.