Adam R.

Context: I run SOC 2, SOC 1 (a few custom controls), PCI DSS 4.0.1, and NIST CSF.

I’d start by doing a gap analysis of the requirements of CPRA/CCPA. I’d wager it’s easier to solo that pair first before going full US Data Privacy via Vanta - Just my $0.02. The multiple frameworks aspect is entirely based on how many automated controls exist within their add-on frameworks. NIST-based ones have historically been lacking in automated controls, but have improved recently.