Preparing for California’s First CCPA Cybersecurity Audits | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

Since Jan. 1, 2026, some businesses have focused on more immediate obligations under the updated California Consumer Privacy Act (CCPA) regulations, including risk assessments and automated decision-making technology (ADMT) requirements. However, for the largest businesses, another deadline is quickly approaching — the first audit period under the CCPA’s new cybersecurity audit rules. 

The first audit period begins Jan. 1, 2027, and advance preparation may help businesses demonstrate a reasonable, well-documented cybersecurity program when the CPPA comes calling. Organizations subject to a CCPA cybersecurity audit should consider completing a cybersecurity readiness assessment under attorney-client privilege before recording any deficiencies in formal audits.

Below, we summarize entities that must complete an audit, what the audits require, and practical steps businesses should consider.

Who Must Complete a CCPA Cybersecurity Audit?

Under the CCPA regulations, a business must complete an annual cybersecurity audit if its processing of consumers’ personal information “presents significant risk to consumers’ security.” That standard is met if, in the preceding calendar year, the business either: (1) exceeds the CCPA’s annual gross revenue threshold of $26.625 million and (a) processed the personal information of 250,000 or more California residents (“consumers”) or households, or (b) the sensitive personal information of 50,000 or more consumers; or (2) derives 50% or more of its annual revenue from selling or sharing consumers’ personal information.

What Are the Key Deadlines?

The first audit reports are phased by a business’s annual gross revenue:

After April 1, 2030, covered businesses must complete an audit each year, with the report due April 1 of the following year. 

Considering a Privileged Readiness Assessment

Businesses that have never undergone any type of cybersecurity assessment (e.g., ISO, NIST or SOC 2) may wish to consider working with counsel to direct privileged readiness reviews of their cybersecurity programs. A readiness assessment may surface weaknesses that the business would prefer to understand and fix before an independent auditor begins testing. Doing that work under privilege offers the business room to assess its program honestly and prioritize remediation. 

The structure of counsel-led reviews may affect whether privilege applies. Courts have ordered businesses to produce cybersecurity reports prepared at counsel’s direction where the assessment looked like ordinary business work, was paid from existing IT budgets, or was widely shared within the company. 

In addition, stakeholders may wish to consider having the assessment performed by a third party that differs from the party conducting the audit. Under the CCPA’s regulations, an auditor may not have developed, implemented, or maintained the program it audits, nor made recommendations about the program beyond its audit findings. Companies should consider the pros and cons of using the same entity for the CCPA cybersecurity audit that was retained by outside counsel for the readiness assessment.

Can Organizations Leverage Existing Audits Under the Regulations?

Yes, businesses that already conduct SOC 2, ISO 27001, or NIST-based assessments may leverage those audits if they meet all of the CCPA’s requirements — or are supplemented to do so. Because the CCPA cybersecurity audit centers on protecting personal information, a few CCPA requirements are not covered by the other cybersecurity audits. Thus, organizations should be mindful of this delta and may wish to supplement such audits to include all unique CCPA requirements.

What Does the Audit Require?

Qualified, Independent Auditor

CCPA cybersecurity audits may be performed by an internal or external auditor, but the auditor must be qualified, objective, and independent, and must use accepted professional auditing standards. Internal auditors must report to an executive who is not directly responsible for the cybersecurity program.

Audit findings must rest on documents reviewed, sampling and testing, and interviews. Businesses must make relevant information available to the auditor, including about service providers and contractors. 

Scope 

The audit must assess the business’s cybersecurity program as a whole, taking into account the business’s size, complexity, and processing activities, as well as each applicable program component. The regulations list a detailed set of components, including:

• multi-factor authentication (including phishing-resistant multi-factor authentication) and strong password practices;
• encryption of personal information at rest and in transit;
• least-privilege access controls, privileged-access management, and prompt access revocation;
• personal information, hardware, and software inventories, including data maps and flows;
• secure configuration, patch management, and change management;
• vulnerability scans, penetration testing, and vulnerability disclosure programs;
• centralized audit-log management and network monitoring;
• cybersecurity training during onboarding, annually, and after a breach;
• secure development practices;
• oversight of service providers, contractors, and third parties;
• retention schedules and secure disposal; and
• incident response planning and testing, and business continuity.

Reporting and Retention

The audit report must go to a member of executive management with direct responsibility for the cybersecurity program, and the business and auditor must retain audit documentation for at least five years. Each year, the business must then submit a written certification of completion to the CPPA, signed by a member of executive management. By signing, the executive is making a sworn statement under penalty of perjury, meaning they can be held legally liable if the statement is false or misleading.

The California Privacy Protection Agency (CPPA)’s Audits Division

Businesses preparing for cybersecurity audits should be aware of a new player at the CPPA. In February 2026, the CPPA appointed its first Chief Privacy Auditor and formally created a new Audits Division. The role comes from the CCPA itself, which directs the agency to appoint a Chief Privacy Auditor “to conduct audits of businesses to ensure compliance.” The Audits Division is staffed by auditors and technologists and is tasked with examining how businesses’ privacy and cybersecurity practices actually work on systems that handle real consumer data.

The Audits Division has broad authority. It may audit a business, service provider, contractor, or person to investigate possible violations, where processing presents significant risk to consumer privacy or security or where there is a history of noncompliance. While the Audits Division’s focus is fact-finding, audits may lead to enforcement. The CPPA has noted that it expects the division to build subject-matter expertise over time, including in cybersecurity audits. 

Accordingly, the agency’s own auditors might one day review the underlying program, the audit file, and the business’s remediation record. The five-year retention requirement and thorough documentation of audits and remediation may therefore take on added significance.

Conclusion

Businesses subject to the CCPA’s April 1, 2028, deadline may wish to consider taking the following steps to prepare for the audit:

• Confirm Applicability. Assess revenue and processing volumes, including sensitive personal information, to determine whether and when the business is covered.
• Brief Leadership. Executive management will receive the report and sign the certification, so confirm that they understand the obligations and the timeline.
• Start With a Privileged Readiness Assessment. Work with counsel to find and remediate gaps before the audit period begins, including mapping existing controls against the regulation’s components, updating data maps and flows, and reviewing service provider and contractor agreements to align with CCPA cybersecurity audit requirements.
• Select Auditor. Decide whether to use internal or external auditors and confirm independence, including reporting lines for internal teams.

Businesses subject to the CCPA’s 2029 or 2030 deadline may wish to consider including a readiness assessment in their 2028 budgets.