# Data Availability Statement — California Cybersecurity Risk Report 2027

## Included in this research package

- **raw-data/ca_ag_breach_register_capture.csv** — verbatim capture of the California Attorney General's public breach-register CSV export (accessed 2026-08-25), covering all notices reported 2024-01-02 through 2026-08-24. This is a public state record; redistribution is permissible.
- **scripts/** — all analysis code: analyze_ag_register.py (register counts, lag, cascades), calc_ic3_california.py (all IC3-derived calculations), make_charts.py (chart generation, including chart data derivation). Python 3; make_charts.py requires matplotlib.
- **calculations/** — computed outputs exactly as produced by the scripts (ag_register_results.txt, ic3_california_results.txt).
- **charts/** — final chart images (CH-01, CH-02, CH-03) with full data values, sources, captions, and alt text in 10_CHART_INDEX.md.
- **03_CLAIM_EVIDENCE_REGISTER.csv** — per-claim traceability for every quantitative statement.

Every figure in the report can be re-derived by running the scripts against the included raw capture.

## Referenced but not redistributed

- **FBI IC3 annual reports (2022–2025).** US government works, freely available at ic3.gov (2025 edition: https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf). Specific figures used are transcribed with page references in the claim register. Access: direct download, no registration.
- **Verizon 2026 Data Breach Investigations Report.** Copyrighted; not redistributed. Access: https://www.verizon.com/business/resources/reports/dbir/ (free download). Fields used: headline breach-pattern, ransomware, third-party, initial-access, KEV-remediation, and ransom-payment statistics, itemized in the claim register.
- **California SB 446 (2025).** Statute text via leginfo.legislature.ca.gov; characterization cross-checked against the legal analyses cited in the source register.

## Canonical live sources

The California Attorney General register is continuously updated; the canonical dataset is the live export at https://oag.ca.gov/privacy/databreach/list-export (searchable list: https://oag.ca.gov/privacy/databreach/list). This package analyzes the register as of 2026-08-25; analyses of the same window run later may differ slightly if the state amends historical entries.

## Update cadence

IC3 annual reports publish each spring for the prior calendar year; the DBIR each spring; the AG register continuously. The next scheduled refresh of this analysis is described in 15_FUTURE_RESEARCH_PLAN.md.