1. (a) If a business partner experiences a break-in, robbery, unauthorized physical trespass, or loss of accountable and/or controlled inventory as a result of these events, a breach of the security of the system containing computerized data, a computer hack or trespass or other breach of either physical or electronic security by any means, the business partner must notify the BPA program administrator within twenty-four (24) hours of the event. If the business partner is a second-line business partner, they must notify both the BPA program administrator and their authorized first-line service provider within twenty-four (24) hours of the event. When a second-line business partner has notified their authorized first-line service provider, the first-line service provider must notify the BPA program administrator within twenty-four (24) hours of that notification. Notice as used herein may be made by telephone, email, or in writing delivered within twenty-four (24) hours. After notification, the BPA program administrator shall place a Security Stop on the business partner's access to the BPA program including the interface.

   1. (1) Within two (2) business days of the effective date of the Security Stop, the BPA program administrator shall deliver to the business partner a List of Actions to remove the Security Stop. The business partner has sixty (60) days following delivery of the List of Actions to comply. The List of Actions may include, but is not limited to, obtaining a new BPA program password, curing the issue leading to the physical or electronic security breach, or other actions necessary to remedy the breach based on the specific facts of the breach.
   2. (2) A business partner may appeal the List of Actions and request a hearing by sending an appeal to the BPA program administration with an explanation as to why the List of Actions is not necessary. The appeal shall be in writing and received by the BPA program administrator within fifteen (15) days after the List of Actions effective date. Pursuant to Title 13, section 225.73(c), a hearing shall be held before the director or the director's designee, and a decision issued within thirty (30) days after receipt by the BPA program administrator of the appeal to the List of Actions.
   3. (3) After completion of the List of Actions, the business partner must notify the BPA program administrator. Notice may be submitted via email or in writing. After receipt of the notice, the BPA program administrator may verify completion of the List of Actions. If the BPA program administrator is satisfied the List of Actions was completed, the Security Stop shall be removed and written notice of such shall be delivered to the business partner via email or in writing. If the BPA program administrator is not satisfied the business partner completed the List of Actions, notice of such will be submitted to the business partner within two (2) business days following the determination by the BPA program administrator that the List of Actions has not been successfully cured. The business partner may continue to attempt completion of the List of Actions as long as the sixty (60) day period has not elapsed. Failure of the business partner to fully complete the List of Actions within sixty (60) days after the effective date constitutes grounds for cancellation of the business partner's permit pursuant to Section 225.73(j)(6).
   4. (4) A business partner may appeal the determination that the List of Actions has not been completed and request a hearing by sending an appeal to the BPA program administrator. The appeal shall be in writing and received by the BPA program administrator within fifteen (15) days after the notice of the deficiency. Pursuant to Title 13, Section 225.73(c), a hearing shall be held before the director or the director's designee, and a decision issued within thirty (30) days after a receipt by the BPA program administrator of the appeal.

Note: Authority cited: Sections 1651 and 1685, Vehicle Code. Reference: Sections 1652, 1653 and 1685, Vehicle Code.

History

1. New section filed 11-5-2025; operative 11-5-2025 pursuant to Government Code section 11343.4(b)(3) (Register 2025, No. 45).