In July 2026 the California Department of Technology published Cal-Secure 2.0, the successor to the state's 2021 cybersecurity roadmap. CDT describes the change as moving from "a compliance-based checklist" to "a flexible, risk-based strategy," organized around three pillars: People, Process, and Technology.
The reason is speed. CDT points to AI-orchestrated attacks and a time-to-exploit window that "has collapsed from months to hours." A security program that verifies controls once a year cannot keep up with that.
What changes in practice
Under a checklist, the question was whether a control existed. Under a risk-based roadmap, agencies prioritize their own risks within a common statewide framework and the roadmap adds a continuous audit, assessment, and improvement program with standardized, automated metrics. Its technology initiatives include accelerated vulnerability and patch management, AI and automation in security operations, stronger cyber recovery capabilities, and preparation for post-quantum cryptography.
Four things platform teams should do now
- Shorten the patch cycle. Automate operating system, container image, and Kubernetes version upgrades so a critical fix can reach production in days. Manual, quarterly patching does not fit a threat model measured in hours.
- Add runtime detection. Preventive controls stop known mistakes; runtime detection catches what gets through. Route alerts to people who can act on them, not to an unread inbox.
- Test recovery, not just backups. Restore a real system to a clean environment on a schedule and record how long it takes.
- Make evidence automatic. Collect configuration state, access logs, and change history continuously, so a risk conversation with your security office starts from data.
Where this meets other state policy
Cal-Secure 2.0 sits alongside existing requirements, not in place of them. State security policy in SAM 5300 and the SIMM 5300 standards still applies, and the state cloud policy in SAM 4983.1 separately requires security plans, zero trust architecture, and enrollment in CDT Security Operations Center monitoring for infrastructure and platform cloud services. Designing a platform to all three at once is far cheaper than retrofitting.