9 CCPA questions every CISO should be prepared to answer