California's privacy regulator is considering narrowing the number of businesses it will require to perform an annual cybersecurity audit.