What It Is

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), is a state regulation establishing consumer privacy rights for California residents. It applies extraterritorially to for-profit businesses meeting thresholds like $25M revenue or handling 100K+ consumers' data. Primary purpose: empower consumers with control over personal information (PI), including broad definitions covering identifiers, inferences, and sensitive PI. Approach: rights-based with operational obligations, enforced by CPPA and Attorney General.

Key Components

• Core consumer rights: know/access, delete, opt-out sales/sharing, correct, limit sensitive PI use
• Business duties: notices at collection, privacy policies, vendor contracts, DSAR handling (45-90 days)
• No fixed controls count; focuses on principles like data minimization, reasonable security
• Compliance model: self-assessed, audited via enforcement, no certification but documentation essential

Why Organizations Use It

Mandatory for qualifying businesses to avoid $2,500-$7,500 per-violation fines and breach litigation ($100-$750 damages). Drives risk reduction, data governance efficiency, consumer trust, market differentiation. Aligns with GDPR-like practices for scalability.

Implementation Overview

Phased: scoping/gap analysis (0-3 months), policies/contracts (1-4 months), technical controls (2-6 months), operationalization/training, ongoing audits. Targets tech/retail/finance; global firms with CA data. No certification; focuses on demonstrable reasonableness via logs/audits.

What It Is

AS9100D (AS9100:2016) is the globally recognized quality management system (QMS) standard for aviation, space, and defense organizations. It builds on ISO 9001:2015 with over 100 aerospace-specific additions, using a risk-based, process-oriented approach to ensure product safety, configuration integrity, and supply chain reliability.

Key Components

• 10-clause Annex SL structure covering context, leadership, planning, support, operation, evaluation, and improvement.
• Aerospace additions: configuration management (8.1.2), product safety (8.1.3), counterfeit parts prevention (8.1.4), operational risk management, human factors, and enhanced supplier controls.
• Built on PDCA cycle; requires certification via accredited third-party audits (Stage 1/2, surveillance).

Why Organizations Use It

• **Market accessOften mandated by OEMs for contracts.
• **Risk reductionPrevents safety incidents, defects, and supply chain failures.
• **Efficiency gainsImproves delivery, reduces rework, enhances competitiveness.
• Builds stakeholder trust through OASIS visibility and proven reliability.

Implementation Overview

• Phased: gap analysis, process design, training, internal audits, certification.
• Applies to all sizes in ASD sectors globally; 6-18 months typical.
• Evidence-driven audits emphasize living processes over documents. (178 words)