The California Privacy Rights Act (CPRA)The California Privacy Rights Act (CPRA) amends and expands the existing California Consumer Privacy Act(CCPA) to further protect California consumers’ rights, including the constitutional right to privacy, while imposing
unique obligations on the covered entities. Just like the GDPR, the main aim of the law is to give more control toCalifornia consumers over their private data collected by companies.
The CPRA is in effect from January 1, 2023, and applies to information collected on or after January 1, 2022. Full
enforcement went into effect on July 1, 2023. Previously, the CCPA was enforced by the California Office of theAttorney General. The CPRA is enforced by the California Privacy Protection Agency (CPPA).
The CPRA does not demand much around security requirements and breach intimations. However, the law takes
a broader view of what constitutes private data. It gives consumers the right to act against data breaches out ofa failure to secure their personal data by companies. To this effect, consumers can sue companies if the privacy
guidelines are not met, even if it did not result in a breach.
As an award-winning, globally trusted IT security company, Sophos recommends that organizations must follow
the below security best practices to stay within the safety realm of the CPRA compliance checklist.
Specifications and descriptions are subject to change without notice. Sophos disclaims all warranties and guarantees regarding this information. Use of Sophos products alone
does not guarantee legal compliance. The information in this document does not constitute legal advice. Customers are solely responsible for compliance with all laws andregulations, and should consult their own legal counsel for advice regarding such compliance.

The California Privacy Rights Act (CPRA)

Security best practice

Sophos solution

How it helps
Secure personal data

Secure stored personal data

Sophos Cloud Optix

Public cloud security benchmark assessments proactively identify shared storage services (e.g. Amazon S3), hard
drive snapshots, and databases without encryption enabled, or with public access enabled and ports exposed.
Guided remediation then instructs the administrator on how to protect these services and data at rest.

Sophos Firewall
Sophos Intercept X
Sophos Intercept X for Server

Data Leakage Prevention (DLP) capabilities in Sophos products can detect sensitive data andcan prevent leaks of such information via email, uploads, and local copying.

Sophos Central Device Encryption

Protect devices and data with full disk encryption for Windows and macOS.

Sophos ZTNA

Continuously validates user identity, device health, and compliance before granting access to applications and data.

Sophos Managed Detection
and Response (MDR)

24/7 monitoring of the environment plus investigation and neutralization of malicious
activities secures against data loss through adversarial activities.

Sophos MobileA rich set of device management capabilities keeps sensitive business email and documents protected on mobile devices –even for users working with personal devices.
Flexible compliance rules monitor device health and flag deviation from desired settings.

Secure data while in transit

Sophos Firewall

Facilitates two-factor authentication for VPN connections, with granular RADIUS/TACACS integration.

Sophos Email

Granular control of data breach prevention policies, including multi-rule policies for groups and individual users with seamlessintegration of encryption. Create custom CCLs using Sophos Content Control Lists or customize out of the box templates for specificCCLs. Choose from a variety of policy outcomes including block, drop attachment, quarantine as well as log and continue mode.

Sophos ZTNA

Validates user identity, device health, and compliance before granting access to resources.

Sophos WirelessCreates dynamic encrypted Wi-Fi sessions, protecting information in transit on Sophos managed networks and hotspots.

Unique User Identification
Users/devices accessing personal
data are uniquely identifiable

All Sophos Products

Sophos’ user-identity-based policy technology allows organizations to enforce role-baseduser-level controls over network resources and other organization’s assets.

Sophos Firewall

Allows user awareness across all areas of our firewall governs all firewall polices and reporting,enabling user-level control over applications, bandwidth and other network resources.

Sophos ZTNA

Constantly verifies the user — typically with multi-factor authentication and an identity provider — and validates
health and compliance of the device for users to securely connect to corporate resources from any location.

The California Privacy Rights Act (CPRA)

Security best practice

Sophos solution

How it helps
Access Control

Multi-factor authentication toconfirm users’ identity

Sophos Firewall

Supports flexible multi-factor authentication options including directory services for access to key system areas.

Sophos Central

Protects privileged and administrator accounts with advanced two-factor authentication.
Keeps access lists and user privileges information up to date.

Limit data access by leastprivilege principle

Sophos ZTNA

Constantly verifies the user — typically with multi-factor authentication and an identity provider — and validates
health and compliance of the device for users to securely connect to corporate resources from any location.

Sophos Email

Granular control of data breach prevention policies, including multi-rule policies for groups and individual users with seamlessintegration of encryption. Create custom CCLs using Sophos Content Control Lists or customize out of the box templates for specific
CCLs. Choose from a variety of policy outcomes including block, drop attachment, quarantine as well as log and continue mode.

Sophos Mobile

Sophos Secure Email and Sophos Secure Workspace in Sophos Mobile store content on mobile devices securely with AES-256
encryption. Access to the content in the apps can be restricted based on device health, compliance rules, time, Wi-Fi, or geo-location.

Sophos Cloud Optix

Adopt the principle of least privilege across public cloud environments with Sophos
Cloud Optix, Cloud Security Posture Management solution.
The SaaS based service connects disparate actions with Sophos AI to pinpoint unusual access patterns
and locations to cloud provider consoles in near real time to identify credential misuse or theft.
It includes an IAM visualization tool that provides a complete map of IAM relationships and allows teams to quickly andeasily identify over-privileged access and create right-sized IAM policies before they are exploited in cyberattacks.

Sophos Central

Configurable role-based administration provides granular control of administrator privileges.
Keeps access lists and user privileges information up to date.

Secure data portability
Prevent unintended or unauthorized
information transfer

Sophos Intercept X

Device Control allows admins to control the use of removable media through policy settings.

Sophos Intercept X for Server
Sophos Firewall
Sophos Intercept X

Data Leakage Prevention (DLP) capabilities in Sophos products can detect sensitive data andcan prevent leaks of such information via email, uploads, and local copying.

Sophos Intercept X for Server
Sophos Central Device Encryption

Protect devices and data with full disk encryption for Windows and macOS.

Sophos Mobile

Encrypts documents within a secure container on a mobile device managed with Sophos Mobile.
Sophos Secure Workspace can dynamically encrypt content sent to cloud-based storage services andapplications. It enforces device encryption and monitors compliance relative to encryption policy.

Sophos WirelessCreates dynamic encrypted Wi-Fi sessions, protecting information in transit on Sophos-managed networks and hotspots.
Automatically classifies neighboring networks to identify attempts to infiltrate an organization
via Wi-Fi. An on-demand scan function shows you the very latest threat data.

Secure transfer of sensitive
information over email

Sophos Email

Granular control of data breach prevention policies, including multi-rule policies for groups and individual users with seamlessintegration of encryption. Create custom CCLs using Sophos Content Control Lists or customize out of the box templates for specificCCLs. Choose from a variety of policy outcomes including block, drop attachment, quarantine as well as log and continue mode.

The California Privacy Rights Act (CPRA)

Security best practice

Sophos solution

How it helps
Security incident management

Deploy networks or information systems
to detect security incidents thatcompromise the availability, authenticity,integrity, and confidentiality of stored
or transmitted personal information

Sophos Network Detection
and Response (NDR)

Monitors network traffic to identify suspicious network flows, allowing Sophos MDR analysts
to identify which devices may be compromised during a security incident.

Sophos Intercept X

Integrates innovative technology like deep learning, anti-exploit, and anti-adversary into malicious traffic detection withreal-time threat intelligence to help prevent, detect, and remediate threats with ease across all devices and platforms.

Sophos Intercept X for Server

Includes rollback to original files after a ransomware or master boot record attack. Provides forensic-level remediation
by eradicating malicious code as well as eliminating nasty registry key changes created by malware.

Sophos Cloud Optix

Establishes guardrails to prevent, detect, and remediate accidental or malicious changes in network
configuration, network traffic, resource configuration, and user behavior or activities.

Synchronized Security in Sophos products

Shares telemetry and health status, enabling coordinated isolation, detection, andmalware remediation across servers, endpoints, and firewalls.

Sophos Managed Detection
and Response (MDR)

Sophos MDR includes full incident response, delivered by a dedicated team of response specialists who areexperts at battling adversaries. Clear procedures and documentation enable consistent info sharing.

Sophos Rapid Response Service

Enables fast assistance, identifying and neutralizing active threats against yourorganization – delivered by an expert team of incident responders.

Audit logs
Track and monitor accessto data resources

All Sophos products

Enables generation of security event logs that can be integrated into a centralized
monitoring program for incident detection and response.

Sophos XDR

Detect and investigate across endpoint, server, firewall, and other data sources. Get a holistic view of your organization’s
cybersecurity posture with the ability to drill down into granular detail when needed. The Sophos Data Lake allows to quickly
answer business critical questions, correlate events from different data sources and take even more informed action.

Sophos Firewall

Allows real-time insights into network and user events, quick and easy access to historical data, andeasy integration with third-party remote management and monitoring tools (RMMs).

Sophos Managed Detection
and Response (MDR)

Sophos MDR detects and investigates suspicious events from across the full security environment to identify threats
and appropriate response activities. Data is collected across endpoint, network, identity email, and more, and thencorrelated using powerful AI tools, threat intelligence and human expertise to identify impact and response.

User awareness and training
Security Awareness Training

United Kingdom and Worldwide Sales
Tel: +44 (0)8447 671131
Email: sales@sophos.com

Sophos Phish Threat

Provides simulated phishing cyberattacks and security awareness training for the organization’s end users. Courses cover a wide
range of topics from phishing and cybersecurity overview lessons, through to data loss prevention, password protection and more.

Sophos Training and Certifications

Training courses and certifications to help partners and customers get the best out of Sophos security
deployments; access to latest know-how and expertise for security best practices.

North American Sales
Toll Free: 1-866-866-2802
Email: nasales@sophos.com© Copyright 2023. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UKSophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
2023-08-02 CC (PS)

Australia and New Zealand Sales
Tel: +61 2 9409 9100
Email: sales@sophos.com.au

Asia Sales
Tel: +65 62244168
Email: salesasia@sophos.com