§1798.155 Administrative Enforcement and Civil Penalties
A business, service provider, contractor, or other person who violates the Act shall be liable for an administrative fine of up to USD 2,500 for each violation or up to USD 7,500 for each intentional violation or violati
4
artefacts
1
held by a system
0
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Minors PI controls and audit trail · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Compliance program documentation defensible against per-violation penalties · Document repository
- Records demonstrating not intentional (training, policies, due diligence) · HR system / LMS
- CPPA/AG inquiry response procedure · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Per-violation calculus not modeled
- Minors-specific controls missing
- No formal regulator inquiry playbook
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet§1798.150 Private Right of Action for Data Breaches · §1798.185(a)(15) Risk Assessments for High-Risk Processing