Los Angeles · Riverside · San Francisco · San Diego
IT support, security and compliance for California companies.
Remote help desk, security monitoring, compliance and vCIO for California businesses and the people who work for them, from Los Angeles to Sacramento.
Photo: Henning Witzel / Unsplash California's economy
The industries that drive California, and how we help them.
California tops CompTIA's list of the largest states for tech employment, and San Jose and San Francisco rank among the metros where tech has the highest economic impact.
How we help: SOC 2, security questionnaires, remote teams and board-level IT guidance for firms that hold client data.
Software & professional services →California had 336,505 life sciences jobs across 15,660 establishments in 2025, with about one-third of that employment in the Bay Area.
How we help: EHR support, HIPAA compliance, telehealth and help desk for practices without IT staff.
Healthcare →California farms and ranches received $64.7 billion in cash receipts in 2025, and the state grows nearly half of U.S. vegetables and over three-quarters of U.S. fruits and nuts.
How we help: Connectivity for remote sites, and the office IT, security and backups behind the operation.
How we help →Travel spending in California reached a record $158.9 billion in 2025, supporting 1.2 million jobs, and the state remains the nation's No. 1 travel destination.
How we help: Guest Wi-Fi kept apart from business systems, card-payment systems kept tightly scoped, and help desk cover for seasonal staff.
How we help →To keep Hollywood production in the state, California expanded its Film and Television Tax Credit Program to $750 million in legislation signed July 2, 2025.
How we help: Fast storage and secure sharing for large media files, and IT for production offices that open and close on a schedule.
How we help →California rules
The California laws that affect your IT.
A breach, a privacy request or an auditor's question lands differently in every state. Here is what California asks of businesses that hold its residents' data.
Data-breach notification
- The law
- Cal. Civ. Code § 1798.82 (businesses; § 1798.29 for state agencies), as amended by SB 446 (signed Oct. 5, 2025, effective Jan. 1, 2026)
- Telling affected people
- "within 30 calendar days of discovery or notification of the data breach" (effective Jan. 1, 2026; replaced the former "most expedient time possible and without unreasonable delay" standard). Delay is permitted for the legitimate needs of law enforcement.
- Regulators
- Attorney General: if more than 500 California residents are notified as a result of a single breach, electronically submit a single sample copy of the notice "to the Attorney General within 15 calendar days of notifying affected consumers" (15-day deadline new Jan. 1, 2026).
- Credit bureaus
- No consumer reporting agency notice requirement in § 1798.82.
- Encrypted data
- Encrypted data is generally exempt (a safe harbor), unless the key was also compromised.
Consumer privacy law
- The law
- California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA); Cal. Civ. Code § 1798.100 et seq.
- In force
- CCPA effective Jan. 1, 2020; CPRA amendments effective Jan. 1, 2023. New CPPA regulations on cybersecurity audits, risk assessments and automated decisionmaking technology (ADMT) effective Jan. 1, 2026, with phased compliance dates.
- Who it covers
- For-profit businesses doing business in California that meet any one of these: annual gross revenue over $26,625,000 (the CPI-adjusted figure effective Jan. 1, 2025; originally $25 million); buying, selling or sharing personal information of 100,000+ California consumers or households; or deriving 50%+ of annual revenue from selling or sharing personal information.
Other California rules worth knowing
Who: Cybersecurity audits apply to CCPA businesses that derive 50%+ of revenue from selling or sharing personal information, or that exceed the revenue threshold and processed personal information of 250,000+ consumers or households, or sensitive personal information of 50,000+ consumers. Risk assessments apply to processing that presents significant privacy risk, such as selling or sharing data, processing sensitive data, or using ADMT for significant decisions.
Covered businesses must complete annual independent cybersecurity audits, with the first certifications due to the CPPA on April 1, 2028 (revenue over $100M), April 1, 2029 ($50M-$100M) or April 1, 2030 (under $50M). They must also conduct risk assessments starting Jan. 1, 2026, with attestations due by April 1, 2028, and meet ADMT requirements by Jan. 1, 2027.
SourceWho: Businesses that own, license or maintain California residents' personal information. The § 1798.150 private right of action applies to CCPA-covered businesses.
Businesses must implement and maintain reasonable security procedures and practices. If nonencrypted, nonredacted personal information is breached because they failed to do so, consumers can sue for statutory damages of $107-$799 per consumer per incident (CPI-adjusted from $100-$750, effective Jan. 1, 2025) or actual damages, whichever is greater, after a 30-day notice-and-cure period.
SourceCurrent as of November 2026. This is general information, not legal advice. Laws change, so confirm the details with counsel before relying on them. We help you put the controls in place and keep the evidence; we are not a law firm.
Supporting California teams
Remote by design, wherever your people work.
Our standard hours, 8am to 6pm Central, are 6am to 4pm Pacific. Critical problems are covered nights and weekends.
Pacific Time (PT)Laptops shipped ready to work, accounts set up on day one, and the same help desk whether someone is in Los Angeles or working from home.
Help desk & managed ITMFA, managed endpoint protection and monitoring on every device, so a laptop on home Wi-Fi is held to the same standard as the office.
CybersecurityCustomers and staff in several states means several sets of rules. We map which apply and build one program that satisfies them.
SOC 2 · HIPAA · vCISOCalifornia questions we get asked
How quickly must a California business notify people after a data breach?
Under Cal. Civ. Code § 1798.82 (businesses; § 1798.29 for state agencies), as amended by SB 446 (signed Oct. 5, 2025, effective Jan. 1, 2026): "within 30 calendar days of discovery or notification of the data breach" (effective Jan. 1, 2026; replaced the former "most expedient time possible and without unreasonable delay" standard). Delay is permitted for the legitimate needs of law enforcement.. Attorney General: if more than 500 California residents are notified as a result of a single breach, electronically submit a single sample copy of the notice "to the Attorney General within 15 calendar days of notifying affected consumers" (15-day deadline new Jan. 1, 2026).
Does California have a consumer privacy law?
Yes: the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA); Cal. Civ. Code § 1798.100 et seq.. It took effect CCPA effective Jan. 1, 2020; CPRA amendments effective Jan. 1, 2023. New CPPA regulations on cybersecurity audits, risk assessments and automated decisionmaking technology (ADMT) effective Jan. 1, 2026, with phased compliance dates.. It applies to For-profit businesses doing business in California that meet any one of these: annual gross revenue over $26,625,000 (the CPI-adjusted figure effective Jan. 1, 2025; originally $25 million); buying, selling or sharing personal information of 100,000+ California consumers or households; or deriving 50%+ of annual revenue from selling or sharing personal information.
Can you support our employees who work remotely in California?
Yes. Help desk, device management, security monitoring and compliance all run remotely, and many of our clients have staff spread across the country. Our standard hours, 8am to 6pm Central, are 6am to 4pm Pacific for your California team, and critical problems are covered nights and weekends.
Do you come on site in California?
Our on-site visits are in Texas. In California, our work is remote, which covers most of what companies need. When something needs hands on hardware, we arrange local help and coordinate it for you.
Thirty minutes, and you will know where you stand.
Thirty minutes, no obligation. Tell us about your California team and we will tell you what we would do and what the ceiling would be.