Search
Find What You Need
Search directly, browse by topic, or start with a practical question. Find useful resources without needing to know how the site is organized.
Browse by topic
Not sure where to start?
I Want To...
Understand AI governanceStart with the four-part foundations series.Prepare for an auditBuild habits that make assurance less disruptive.Understand California privacyExplore CCPA requirements and examples.Determine whether CCPA appliesUse the free applicability assessment.Find a definitionBrowse sourced governance and assurance terminology.
Featured
Useful Places to Explore
Free tool
CCPA Applicability Assessment
Create a documented, printable applicability signal.
Start assessmentCompliance tip5 Ways to Not Dread Your Compliance Audit
Build better audit habits before fieldwork begins.
Read tipCompliance tipDetermine Your CCPA Compliance Annually
Make legal scope a documented governance decision.
Read tipLearning seriesAI Governance Foundations
Learn accountability, risk, controls, evidence, and assurance.
Start learningSearch results
Resources
No resources match that search. Browse Learn or the Glossary.
- GuideHow to Build a CCPA-Compliant Privacy PolicyA practical guide to the CCPA privacy-policy requirements and the program facts needed to support them.
- Worked exampleGhostRecruiter Sample CCPA Privacy PolicyA fictional privacy policy showing how CCPA disclosures can connect to underlying business facts.
- California privacyYou're In Scope for the CCPA. Now What?A practical roadmap from CCPA applicability to privacy policies, consumer rights, risk assessments, ADMT, cybersecurity audits, and data-broker obligations.
- HomeHomeAuditDIFF connects AI governance requirements to implementation, evidence, and assurance.
- LearnLearnLearning paths for AI governance and related assurance concepts.
- LearnAI GovernanceAI governance foundations, implementation, evidence, and assurance.
- Learning seriesAI Governance FoundationsA four-part introduction to accountability, risk, evidence, and independent assurance.
- Learning seriesWhat Is AI Governance?Part 1 of AI Governance Foundations: a practical definition and the structure behind accountable AI oversight.
- Learning seriesRoles and AccountabilityPart 2 of AI Governance Foundations: ownership, decision rights, escalation, and evidence of accountability.
- Learning seriesRisk, Controls, and EvidencePart 3 of AI Governance Foundations: how risk becomes controls, evidence, monitoring, and testing.
- Learning seriesIndependent AssurancePart 4 of AI Governance Foundations: readiness, audit, independence, criteria, and evidence.
- Learning seriesCatastrophic AI RiskA six-part practitioner series on severe AI harm, frontier safety lessons, safety engineering, downstream risk, controls, evidence, and audit questions.
- Learning seriesWhy You Should Care About Catastrophic AI RiskWhy catastrophic-risk thinking matters even when an organization does not build frontier models.
- Learning seriesWhat California and Illinois Are Actually RegulatingA plain-language look at the frontier-AI scope of California and Illinois catastrophic-risk laws.
- Learning seriesStart With the Harm and Work BackwardUse ideas from safety engineering to map severe harm, pathways, controls, and evidence.
- Learning seriesYour Model Provider Does Not Own All of Your RiskHow upstream model safeguards, deployment choices, third-party dependencies, and feedback shape downstream AI risk.
- Learning seriesAuditing the Risk ChainPractical questions for testing severe AI risk pathways, controls, feedback, response, evidence, and residual risk.
- AI governanceAI Auditor Registration Is Becoming a Requirement in CaliforniaHow AB 1405 and SB 813 establish AI auditor registration, independence, evidence retention, and independent verification requirements.
- ToolsToolsPractical checks, including the free CCPA Applicability Assessment and a sample CCPA risk assessment.
- ToolsFree CCPA Applicability AssessmentA browser-only assessment that helps determine whether your organization likely needs to comply with the CCPA and produces a printable determination.
- Compliance tipCompliance Tip: Determine Your CCPA Compliance AnnuallyWhy documenting and annually revisiting CCPA applicability is useful governance even though an annual determination is not a CCPA requirement.
- Compliance tip5 Ways to Not Dread Your Compliance AuditPractical habits for making compliance audits less disruptive and more predictable.
- Compliance tip5 Ways to Modernize Your AuditModernize audit readiness with planning, appropriate support, evidence automation, and deliberate compliance tooling.
- Compliance tipCCPA vs. CPRA: Why People Still Use Both NamesA plain-language explanation of how the CPRA amended the CCPA and why both names remain common.
- GlossaryGlossaryA sourced reference index for AI governance, privacy, cybersecurity, risk, and assurance terminology.
- AboutAboutThe AuditDIFF mission and its independence from other organizations.
- California privacyCCPA Risk AssessmentsA practical guide to California's CCPA risk-assessment requirements, including triggers, documentation, timing, stakeholder involvement, and submission.
- California privacyA Sample CCPA Risk AssessmentA fictional CCPA risk assessment for GhostRecruit, a SaaS hiring platform, showing required California elements and clearly labeled optional governance additions.
- California privacyProcessing Risk, Not Business Size, Triggers CCPA Risk AssessmentsA practical guide to determining when a CCPA-covered business must conduct a risk assessment under Article 10.