California’s potential approach to regulations on risk assessments and cybersecurity audits could be a game changer