Many California State Entities' Information Assets Vulnerable to Attack (auditor.ca.gov)

"at its current pace it would take the technology department roughly 20 years to audit all reporting entities."

Also, interesting data presented here: http://www.auditor.ca.gov/reports/2015-611/auditresults.html