Your Clients Already Have a Security Question.
Here's How to Answer It.
A plain-language breakdown of the 18 cybersecurity controls every small business should know, and what it means when you can't point to any of them.
When a client asks how you protect their data, most small business owners have a reasonable answer. Good habits, solid software, a trustworthy team.
But having a reasonable answer and having verifiable proof are two different things. Your clients know the difference.
As of January 1, 2026, California SB 446 (amending Cal. Civ. Code § 1798.82) requires any business that handles personal information to notify affected clients within 30 days of a breach. There is no exemption for small businesses. No minimum size threshold.
The 18 areas in this guide give a professional services business a practical starting point for showing clients something real when the question comes.
This guide breaks them down in plain language. No IT background required.
What these 18 areas are
The 18 areas in this guide are Legacy Core's own plain-language checklist for small businesses. They are not the CIS Critical Security Controls, a separate list of 18 published by the Center for Internet Security. They are also not the 18 components in California's CCPA cybersecurity-audit regulation. Legacy Core's credentialing pathway is aligned with NIST CSF 2.0 and CIS Controls v8. Legacy Core is not affiliated with, endorsed by, or accredited by CIS, NIST, or any government agency.
This checklist is an awareness starting point: knowing the 18 areas, what you already have in place, and where the gaps are.
This checklist is a free starting point. It is not the credential standard, and checking off all 18 areas does not earn a Trust Badge.
California Just Removed the Small Business Exemption
California SB 446, effective January 1, 2026, amends Cal. Civ. Code § 1798.82 and requires any business handling personal information to notify affected clients within 30 days of a data breach, regardless of company size.
A two-person CPA firm now carries the same breach notification obligation as a 500-person corporation.
Working through the 18 areas in this guide can help you organize and document the steps your business takes, before a client, an insurer, or a regulator asks. It does not establish legal compliance.
CCPA cybersecurity audits
California's CCPA cybersecurity-audit regulations took effect January 1, 2026. Whether a business must complete an audit depends on the criteria in Cal. Code Regs. tit. 11, §7120, and first-audit deadlines are phased under §7121. Section 7123(c) lists 18 components an audit must assess, where applicable. That list is separate from the 18 areas in this guide. Legacy Core tracks §7123(c) as a monitored reference in Standards Releases. Our educational materials also address CCPA/CPRA awareness. This guide is not an audit.
This guide is a public control reference. It is not Legacy Core's evidence checklist, scoring method, or Silver and Gold requirements.