Studies and surveys consistently show that cybersecurity and data protection is one of the top five concerns of internal auditors, who worry that their organizations lack the internal resources to deal with security risks. On January 1, 2020, the California Consumer Privacy Act (CCPA) became effective, requiring new data privacy measures at most US organizations. Yet it is estimated that less than 10 percent are fully prepared for compliance with CCPA. Unfortunately, in this case, ignorance is not bliss and may result in hefty fines.