Practical Considerations to Comply with the CCPA Cybersecurity Audit Requirements

California’s updated CCPA regulations, which became effective January 1, 2026, created a formal cybersecurity audit obligation for certain businesses whose processing of personal information presents “significant risk to consumers’ security.” This is the first of the generally applicable state privacy laws to mandate independent cybersecurity audits for certain businesses. This requirement is especially significant for consumer-facing and data-intensive organizations (including online platforms, adtech, retailers, and any business that sells/shares personal information or processes sensitive personal information at scale). While many organizations already conduct security assessments, these rules add new scope, independence, documentation, retention, and certification expectations.

This article explains (1) who is covered by this new requirement, (2) how the annual cybersecurity audit cycle works, (3) cybersecurity auditor qualifications, (4) what to expect for audit documentation and executive certification, and (5) practical steps to prepare—especially for organizations that already follow NIST, ISO 27001, SOC 2, CIS Controls, or NYDFS-style requirements.

1) The requirement in plain English

Covered businesses must complete an annual cybersecurity audit performed by a qualified, objective, independent auditor. The audit evaluates whether the business’s cybersecurity program protects personal information from:

• unauthorized access, destruction, use, modification, or disclosure; and
• loss of availability of personal information.

Each year a business is required to complete the audit, it must submit a written certification of completion by April 1 of the following year to the California privacy regulator (CalPrivacy), signed by an appropriate executive under penalty of perjury.

2) Who is covered? (the “significant risk of consumers’ security” triggers)

A business is subject to the cybersecurity audit requirement when its processing presents a “significant risk to consumers’ security.” Practically, the thresholds are met if either:

• Data sale/sharing revenue trigger: The business derives 50% or more of annual revenue from selling or sharing consumers’ personal information; or
• Revenue + volume trigger: The business exceeds the CCPA revenue threshold (inflation-adjusted; commonly referenced around $26.6M) and processes, in the preceding calendar year:
  • personal information of 250,000+ consumers/households, or
  • sensitive personal information of 50,000+ consumers/households.

Organizations that are familiar with the CCPA’s scoping requirements for a “business” will see analogies with these “significant risk to consumers’ security” scoping requirements:

3) Timeline and the annual audit cycle

If a business meets the “significant risk to consumers’ security” scoping requirements, then its first certification due date depends on its annual gross revenue:

• April 1, 2028: revenue over $100M
• April 1, 2029: revenue $50M–$100M
• April 1, 2030: revenue under $50M

What can be easy to miss is that the first certification deadline requires that the first audit period begins as early as January 1, 2027.  This creates real lead time needs for:

• auditor sourcing and contracting,
• evidence collection processes,
• vendor cooperation, and
• remediation work the organization wants to complete before the end of the evaluation period.

4) Auditor independence and qualifications

The auditor may be internal or external but must have cybersecurity and audit expertise and be able to exercise objective and impartial judgment free from business influence.

A critical practical point is that independence is not only about reporting lines; it is also about what the auditor does. Independence can be undermined if the auditor participates in building the program being audited (i.e., if the internal or external auditor helped draft core program documents, designed procedures, or implemented controls).

If using an internal auditor, governance must support independence. For example, the highest-ranking auditor must report to an executive who does not have direct responsibility for the organization’s cybersecurity program, with that executive controlling evaluation and compensation for the auditor. Using a specialized external auditor avoids a lot of the quality, objectivity, and independence pitfalls, but the business will need to allocate appropriate lead time to select and negotiate the agreement with the external auditor.

5) What the cybersecurity audit evaluates

The cybersecurity regulations identify 18 cybersecurity program components the auditor should evaluate to the extent applicable to the business’s information systems, in light of the business’s size, complexity, and risk profile. This is an explicitly risk-based standard (not every component will look the same for every organization), but the list is broad and spans governance, technical controls, and operational discipline.

Common themes include:

1. Authentication controls
2. Encryption
3. Account management and access controls
4. Inventory and management of personal information and business’s information system
5. Secure configuration of hardware and software
6. Vulnerability management
7. Audit log management
8. Network monitoring and defenses
9. Antivirus and antimalware protection
10. Network segmentation
11. Ports, services, and protocol management
12. Cybersecurity awareness
13. Cybersecurity education and training
14. Secure software development
15. Vendor management
16. Data retention and disposal
17. Incident response management
18. Business continuity and disaster recovery

6) Leveraging existing frameworks (NIST/ISO/SOC 2/CIS/NYDFS)

Many businesses will be able to leverage their audit work performed for other purposes if it meets the CCPA audit requirements on its own or through supplementation. That said, regulators and auditors are focused on whether the work product actually satisfies the CCPA-specific scope and independence expectations.

Organizations with strong NIST CSF / ISO 27001 / SOC 2 coverage often still need targeted enhancements in areas like:

• Personal information-centric inventories and classification (not just IT asset inventories),
• Vulnerability disclosure (formal vulnerability disclosure program or bug bounty governance), and
• Broad MFA scope (not just employees, often contractors and other non-employee access paths).

It is recommended that the auditor does a deliberate crosswalk to map existing controls and evidence to the 18 components of the CCPA cybersecurity audit; then define a small, explicit “supplement set” so the final audit package clearly meets the CCPA audit set.

7) Audit records and retention

A compliant audit report must be able to stand on its own and typically includes:

• the information systems assessed and the criteria used;
• what evidence was examined (and why it supports findings);
• findings across the applicable components;
• identification of gaps/weaknesses and a remediation plan with timelines; and
• additional context that shows the audit did not rely primarily on management assurances.

The business and auditor must retain all audit-related records for at least five years after completion.

The annual certification is submitted directly to CalPrivacy, but the audit report itself is not submitted as part of the standard certification submission process. CalPrivacy can however specifically request the cybersecurity audit report. Therefore, the business should assume the report must withstand scrutiny if requested by CalPrivacy or obtained through the legal process.

8) Certification of completion

Each year the business is required to complete a cybersecurity audit, it must submit a written certification of completion through CalPrivacy’s website by April 1 of the following year.  The certificate must be signed by an executive of the business.  The executive must:

• be directly responsible for cybersecurity-audit compliance,
• have sufficient knowledge of the business’s cybersecurity audit to submit accurate information, and
• have authority to submit the business’s certification to CalPrivacy.

The certification is an attestation under penalty of perjury and includes a point of contact, confirmation that the audit was completed, the period covered, and a declaration that the business did not attempt to influence the auditor’s decisions or assessments.

9) Best practices to prepare for a CCPA cybersecurity audit

• Determine applicability and tier. Confirm whether your business meets the audit triggers and which revenue tier drives your first certification date.
• Engage counsel and set governance. Decide how you want to structure privilege and internal review for audit preparation, remediation, and final documentation.
• Select an auditor early. Capacity constraints are likely as deadlines approach; contract terms (confidentiality, ownership, liability, data handling) can become the bottleneck.
• Crosswalk existing frameworks to the 18 components. Identify what you already have (SOC 2/ISO/NIST/CIS) and define a focused supplement plan.
• Build an “audit-ready” evidence binder. The goal is durable, repeatable evidence, not a one-time scramble (policies, inventories, training records, logs, vendor reviews, IR exercises).

10) Conclusion

California’s new cybersecurity audit requirement creates a unique audit obligation for businesses that meet the defined “significant risk to consumers’ security” threshold. To prepare, businesses should align audit controls to recognized frameworks, implement auditor independence structures, and prepare to submit a certificate of completion by the statutory deadline. The cybersecurity audit should be treated as an annual compliance cycle to demonstrate ongoing, risk-based accountability for consumer data security.

Chris Achatz is a commercial partner at KO Law who represents companies in structuring and negotiating complex technology and data-related transactions, including data privacy and security matters. He can be reached at [email protected].