CCPA Cybersecurity Audit Requirements: Building an Audit-Ready Security Program

CalPrivacy’s cybersecurity audit regulations took effect on January 1, 2026, establishing the first comprehensive cybersecurity audit regime imposed by a state privacy law of general application. The regulations require businesses whose processing of personal information presents a “significant risk to consumers’ security” to complete annual, evidence-based cybersecurity audits and to certify completion to the agency under penalty of perjury.[1]

These new rules elevate cybersecurity compliance beyond security and information-technology functions. Covered businesses will be expected to demonstrate, with evidence, that their cybersecurity programs are appropriately designed and actually operating during the period under review, and to document any security weakness and remediation commitments. Cybersecurity is therefore becoming a business integration and governance concern.

Which Businesses Are Covered

The audit requirement does not apply to every business subject to the CCPA. A business should complete its cybersecurity audit if it engages in processing that is considered a “significant risk” and the business either:

derives at least half of its annual revenue from selling or sharing consumers’ personal information; or
has more than $25 million in annual gross revenue and processes personal information at sufficient scale—either personal information relating to at least 250,000 consumers or households, or sensitive personal information relating to at least 50,000 consumers.

Importantly, the CCPA defines “consumer” broadly to include employees, applicants, and business contacts, so businesses may meet these thresholds even if they are not processing customer data at the threshold level. Also, and importantly, these thresholds include processing of employee, applicant, and business contact information, and the thresholds are not limited to sensitive information and include personal information, which includes ordinary identifiers like IP addresses and names.

The first step for any potentially covered business should be a deliberate coverage analysis based on actual data volumes rather than assumptions about the nature of the company’s business.

The Compliance Timeline

Initial audit deadlines are staggered by revenue, with the biggest companies facing the nearest deadlines:

Annual Gross Revenue	First Audit Report Due	Audit Period Covered
Over $100 million (as of January 1, 2027)	April 1, 2028	January 1, 2027 – January 1, 2028
$50 million to $100 million (as of January 1, 2028)	April 1, 2029	January 1, 2028 – January 1, 2029
Less than $50 million (as of January 1, 2029)	April 1, 2030	January 1, 2029 – January 1, 2030

After April 1, 2030, a business that meets the significant-risk criteria and reporting thresholds as of January 1 of a given year must complete an audit covering the following 12 months and complete its report by April 1 of the year after that.

Auditor Qualifications and Independence

The cybersecurity audit must be performed by a qualified professional with cybersecurity and audit expertise, using recognized professional standards.

The auditor may be internal or external, but must exercise objective and impartial judgment, be free of conflicts, and remain uninfluenced by the business, including its owners, managers, and employees. Critically, the auditor may not participate in activities the auditor may assess in a current or future audit. That bars the same person or team from developing the business’s security procedures, preparing its documentation, implementing or maintaining the program, or making recommendations about the program beyond articulating audit findings. Companies that have relied on a single trusted consultant to both build and evaluate their security posture will need to separate those roles. In addition, where a company performs a pre-audit check with an external auditor to assess its security program, the company should use a separate auditor for the cybersecurity audit that is reported to CalPrivacy to ensure the appropriate level of independence.

Where an internal auditor is used, the highest-ranking auditor must report to an executive who does not have direct responsibility for the cybersecurity program, and that executive must handle the auditor’s performance review and compensation, again, to ensure independence.

Further, businesses must cooperate in the audit process where necessary. Businesses must provide all requested relevant information, disclose relevant facts in good faith, and not misrepresent them. And findings may not rest primarily on management assertions or attestations—they must be grounded in specific evidence such as documents, testing and sampling, and interviews. Both the business and the auditor must retain audit-related records for at least five years.

Scope: Eighteen Components, Applied by Risk

The audit’s overall objective is to assess how the cybersecurity program protects personal information against unauthorized access, destruction, use, modification, or disclosure, and against unauthorized activity resulting in loss of availability. The audit must evaluate whether the program is appropriate to the business’s size, complexity, and nature and scope of processing, and how the business implements and enforces it.

The areas addressed are:

Authentication and password standards
Encryption at rest and in transit
Account management and access controls
Personal information and asset inventories
Secure configuration and patch management
Vulnerability scanning and penetration testing
Audit log management
Network monitoring and defenses
Antivirus and antimalware protections
System segmentation
Control of ports, services, and protocols
Cybersecurity threat awareness
Education and training
Secure development and code review
Oversight of service providers, contractors, and third parties
Retention schedules and secure disposal
Incident response management
Business continuity and disaster recovery

The 18 items are evaluation points rather than a checklist, and the auditor—not the business—determines which are applicable based on the size and nature of the business’s processing. Scope also follows the data rather than the corporate perimeter. Any environment where California personal information is stored, processed, or accessed—cloud services, end-user devices, backups, and third-party environments—falls within the audited information system, regardless of who owns the infrastructure.

What the Audit Report Must Contain

The audit report must describe the information system and the policies assessed, identify the criteria used, and specify the evidence examined, with an explanation of why that scope, criteria, and evidence support the findings. It must address the applicable components, describe how policies are implemented and enforced, and explain their effectiveness.

The report must also identify up to three titles of individuals responsible for the cybersecurity program, name the auditor and describe their qualifications, and include the highest-ranking auditor’s signed certification attesting to an independent, objective, evidence-based review.

Annual Certification to CalPrivacy

For each year an audit is required, the business must submit a written certification to CalPrivacy through its website by April 1 of the following year. The certification—not the audit report—is what goes to the agency, though the report itself is subject to production on request.

The certification must be completed by a member of executive management who is directly responsible for audit compliance, has sufficient knowledge of the audit to provide accurate information, and has authority to submit it. It must identify the business and a contact person, state that the audit was completed, identify the audit period by month and year, and include an electronically signed attestation, under penalty of perjury, that the information is true and correct and that the business made no attempt to influence the auditor’s decisions or assessments.

The personal attestation requirement is the mechanism that moves this obligation from the security team to the executive suite. An officer signing under penalty of perjury will reasonably want to understand how scoping decisions were made, what gaps were found, and how auditor independence was preserved.

Leveraging Existing Work

Businesses need not start from scratch. CalPrivacy has confirmed that an audit, assessment, or evaluation prepared for another purpose may be used if, alone or with reasonable supplementation, it fully satisfies every requirement. Many companies complete periodic audits of their data security infrastructure already, and CalPrivacy does not want to significantly disrupt those processes already in place.

Coordinating with Risk Assessments and the Audits Division

Much of the underlying work overlaps with CalPrivacy’s risk assessment requirements, including mapping processing activities, inventorying data, identifying controls, and documenting the rationale for decisions. Companies should build these programs together rather than in sequence.

Your Key Next Steps

Determine whether the requirements apply. Confirm revenue and data-processing volumes, including employee, applicant and business contact information where applicable.
Identify the company’s first audit period. Work backward from the beginning of that period—not the report deadline—to determine when controls and supporting evidence must be operational.
Assess the current cybersecurity program against the audit requirements. Companies with existing assessments should identify what can be reused and where additional work will be required.
Test whether controls are producing evidence. A control that exists but cannot be demonstrated may create the same audit challenge as a control that does not exist. Companies should confirm now that logging, testing, monitoring and documentation will support the eventual audit.
Resolve auditor independence. Determine who will perform the audit and ensure that advisory, implementation and audit responsibilities are appropriately separated.
Review third-party risk management. Identify where personal information resides outside the company and whether vendor oversight and contractual protections are sufficient to support the audit.
Consider an internal mock audit before the formal audit period. Identifying deficiencies early gives the business time to remediate them before they become findings in a formal audit report.
Identify the responsible executive. The person who will eventually make the required certification should have visibility into the program and the audit process well before the certification deadline.

Because decisions made at the outset can affect audit scope, privilege, remediation strategy and the record ultimately available to regulators, businesses should involve privacy and cybersecurity counsel early in the process. The Coblentz Data Privacy and Cyberseccurity team can help companies assess whether the requirements apply, structure their readiness efforts, and coordinate with security teams and auditors before the formal audit period begins.

Fall Privacy Webinar – November 17, 2026

Join Scott Hall and members of the Coblentz Data Privacy Team on Tuesday, November 17, 2026 for a timely discussion of the latest developments shaping the privacy, cybersecurity, and AI landscape and what they mean for your business. Learn practical steps to manage risk and gain insight into emerging state and federal AI developments; new and amended consumer privacy laws; enforcement trends involving children’s and sensitive data; and key privacy litigation and regulatory developments. RSVP for the webinar here.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.

[1] Cal. Code Regs. tit. 11, §§ 7120–7124.