What is reasonable security in California? Start with CIS

If your firm holds client account numbers, Social Security numbers or health information about California residents, California law already requires you to maintain reasonable security. The statute never says what reasonable means, and that question usually gets answered after an incident, by someone outside the firm.

Does California law define reasonable security?

No. Cal. Civ. Code § 1798.81.5 requires a business that owns, licenses or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information. The statute stops there. It does not list controls, name a framework or set a test. It also exempts some businesses, including HIPAA covered entities, financial institutions subject to the California Financial Information Privacy Act and businesses regulated by a law that gives personal information greater protection, where compliance with that law counts as compliance with this section. Ask counsel which standard applies to your firm.

For a chief compliance officer at an RIA or a managing partner at a professional firm, that silence is the problem. The standard is applied after the fact, usually after an incident, by a plaintiff's lawyer, a regulator or a court. The test is whether the security you had was reasonable for the data you held.

Why do the CIS Controls matter for that question?

The CIS Controls matter because California's Attorney General named them as the minimum for reasonable security. In the February 2016 California Data Breach Report, the Attorney General's first recommendation said the 20 controls in the Center for Internet Security's Critical Security Controls set a minimum level of information security that all organizations collecting or maintaining personal information should meet, and that failing to implement all the controls that apply to an organization's environment constitutes a lack of reasonable security.

Two caveats keep this honest. The report is guidance, not a regulation, and no court is bound by it. And the report referred to 20 controls; the CIS Controls have since been reorganized into 18. Even so, it remains the most specific public statement from a California enforcer about what reasonable looks like, and it points at a framework that is free, current and written for organizations without a large security team.

What is at stake if a breach happens?

The main exposure is a consumer lawsuit under the CCPA. Under Cal. Civ. Code § 1798.150(a)(1), a consumer whose nonencrypted and nonredacted personal information is accessed and exfiltrated, stolen or disclosed because a business failed to maintain reasonable security may sue for statutory damages or actual damages, whichever is greater. Statutory damages were adjusted to $107 to $799 per consumer per incident effective January 1, 2025, and the California Privacy Protection Agency adjusts them every odd-numbered year. Across a full client list, that range adds up quickly.

Financial firms should note one detail. The CCPA exempts personal information covered by the Gramm-Leach-Bliley Act from most of its requirements, but that exemption does not apply to § 1798.150. An RIA, broker-dealer or insurance agency that relies on the GLBA exemption for privacy notices and consumer requests is still inside the breach lawsuit provision, and in that lawsuit the central question is whether security was reasonable. Our article on whether the CCPA GLBA exemption covers your whole firm covers the rest of that exemption.

Which CIS safeguards should a smaller firm start with?

A smaller firm should start with Implementation Group 1 (IG1). CIS defines IG1 as a foundational set of 56 safeguards for enterprises with limited IT and security expertise, and calls it an emerging minimum standard of information security for all enterprises. That language lines up closely with the Attorney General's minimum-level framing, which makes IG1 a defensible place to draw the first line.

In practice, the IG1 safeguards that most often decide an incident review fall into a few groups:

• Know what you have. Controls 1 and 2 call for an inventory of enterprise assets and software. You cannot argue a laptop was protected if nobody knew it existed. Our guide to CIS Controls 1 and 2 covers how to build that inventory.
• Control who gets in. Controls 5 and 6 cover account inventories, removing dormant accounts, and multifactor authentication for remote and administrative access.
• Patch on a schedule. Control 7 asks for a documented vulnerability management process with automated patching of operating systems and applications.
• Be able to recover. Control 11 covers backups that are protected and tested, and Control 17 covers who does what during an incident.

Our walkthrough of all 56 IG1 safeguards goes control by control. Firms holding regulated client data, such as account numbers or health information, will usually find that some IG2 safeguards also apply to their environment, and the Attorney General's wording refers to every control that applies to an organization's environment.

How does CIS fit with the frameworks your regulators already use?

The CIS Controls sit underneath those frameworks as the operational layer. Regulation S-P, the FTC Safeguards Rule and HIPAA each require written policies and safeguards, but they describe required elements and outcomes rather than a full, testable control list. The CIS Controls supply that list: specific safeguards an IT team can implement and a reviewer can test. Version 8.1, released June 25, 2024, added a governance security function that CIS says helps adopters identify the policies, procedures and processes they need and gives them the evidence to demonstrate compliance.

California is also moving toward formal testing. The California Privacy Protection Agency's regulations, effective January 1, 2026, require annual cybersecurity audits from businesses whose processing presents significant risk to consumers' security, with certifications due April 1, 2028 for businesses over $100 million in revenue, April 1, 2029 for $50 million to $100 million, and April 1, 2030 for those under $50 million. A firm that already runs to the CIS safeguards and keeps evidence will have far less to build if those audits reach it.

What should your firm do this quarter?

This quarter, score the firm against IG1, put every gap on a dated plan and start keeping evidence. A practical sequence for the next 90 days:

• Score the firm against the 56 IG1 safeguards: implemented, partially implemented, or not implemented. Be candid; the score is for you.
• Decide which IG2 safeguards apply because of the data you hold, and write down why the rest do not.
• For every gap, record an owner, a target date and any interim measure in a risk register. A documented, dated plan reads very differently from an undocumented gap.
• Collect evidence as you go: MFA enrollment reports, patch compliance reports, backup restore tests, the account review you ran last month.
• Brief the partners or the board on the score and the plan, and minute it. Oversight that is written down is easier to show later.

This article describes what the statute and the Attorney General's guidance say. Whether a particular program is reasonable for your firm is a question for your counsel, and the evidence above is what they will ask to see.

How does s90 help?

s90 runs managed IT for compliance-focused firms in Los Angeles and Orange County, and we use the CIS Controls as the operating baseline for the environments we manage. We score where you stand, close the gaps on a dated plan, and keep the evidence current so it is ready when someone asks. Our agreements commit to notifying you of a breach within 72 hours and producing evidence within 24 hours of a request. If you want to see where your firm stands against IG1, start with a conversation.