In January 2026, new regulations under the California Consumer Privacy Act (“CCPA”) took effect establishing requirements for risk assessments, automated decision-making, and cybersecurity audits. Many companies have understandably prioritized requirements impacting product design and consumer rights. The cybersecurity audit requirements, however, may present unique challenges, even for companies that have existing, mature cybersecurity programs. Businesses with over $100 million in annual revenue must complete the cybersecurity audit required by the regulations by the end of 2027 (and certify that they have done so by April 2028). Although those deadlines are more than a year away, businesses should begin preparing now to address key decision points before the audit process begins, especially because audits can often take many months from start to finish.
Applicability
The regulations do not require every business subject to the CCPA to conduct cybersecurity audits. Instead, businesses whose processing of consumers’ personal information presents a “significant risk to consumers’ security” and meet one of the following criteria must comply:
- Derive 50% or more of their annual revenue from selling or sharing consumers’ personal information; or
- Generate at least $26,625,000 in gross annual revenue and:
- Processed the personal information of 250,000 or more California consumers the previous calendar year; or
- Processed the sensitive personal information (as that term is defined in the CCPA) of 50,000 or more California consumers in the previous calendar year.
Importantly, the criteria for whether processing poses a “significant risk” for purposes of assessing applicability of the cybersecurity audit rule is wholly unrelated to the criteria for what constitutes a “significant risk” that triggers risk assessment requirements in a different section of the regulations.
Scoping Challenges
The regulations identify eighteen components of a business’s cybersecurity program that an auditor must assess, including asset inventory, access controls, authentication, encryption, logging and monitoring, and other security policies and procedures. The auditor ultimately has discretion to determine how and whether these components apply based on the company’s size, complexity, information systems, processing activities, and cybersecurity risks.
Although these requirements may appear straightforward, even companies with mature cybersecurity programs should not assume that existing processes will satisfy the CCPA audit standard. Scoping the audit can require several threshold determinations, including:
- Which entities are covered. Companies with multiple subsidiaries or affiliates must determine which entities make up the “business” subject to the rule.
- How the CCPA audit scope differs from existing audits. Standard security assessments, such as SOC 2 audits, often focus on customer- or consumer-facing systems. The CCPA audit may also reach enterprise systems, which could broaden the scope of work.
- How to treat vendor-provided systems. Because many vendor systems operate under shared-responsibility models, businesses should identify what evidence is available to show the appropriate limits of their responsibility as compared to the applicable vendor.
These scoping decisions will shape the evidence the auditor requests, the personnel involved in the engagement, and the content of the audit report. Organizations with decentralized security functions or complex corporate structures should expect this exercise to take time and resources before the formal audit begins. Outside counsel can be particularly helpful in advising on how to create a legally-defensible audit scope.
Timing Considerations: Audits and Pre-Audits
The audit timing and resulting report carry important practical implications. Businesses with more than $100 million in 2026 gross annual revenue must conduct an audit covering the period from January 1, 2027, through January 1, 2028, and certify completion to the CPPA by April 2028. Businesses with 2026 gross annual revenue between $50 million and $100 million must complete their first audit by January 1, 2029; businesses with less than $50 million in gross annual revenue must complete their audit by January 1, 2030.
The regulations require the audit report to describe any gaps, weaknesses, and remediation activities identified during the full audit period. As a result, if a business conducts its first compliance assessment during that period and identifies deficiencies, the auditor’s report would need to include such deficiencies—even if the business fully remediates them before the report is finalized.
Deficiencies do not need to be reported proactively to the CPPA, and their existence does not prevent certification. The regulator, however, may request the underlying audit report and could take action based on identified weaknesses. For that reason, organizations may want to separate the work into two phases: first, a readiness assessment before the audit period begins; and second, the required formal audit. Completing remediation before the first reporting period starts could produce a cleaner audit report, which is worth considering given that the report may be discoverable in litigation and available to regulators.
Strategically Leveraging Existing Audit Processes and Certifications
The regulations allow businesses to rely on cybersecurity audits conducted for other purposes, but only to the extent those audits satisfy the CCPA’s requirements or are supplemented to do so. Companies with SOC 2 reports, ISO/IEC 27001 certifications, HITRUST assessments, or NIST-based reviews therefore have a head start, but the certifications are not clean substitutes.
Many of those assessments provide useful evidence regarding the design or effectiveness of security controls. However, they may not address every element required in the CCPA audit report, such as the auditor’s basis for determining scope, the cybersecurity program components evaluated, identified deficiencies and remediation efforts, and the lead auditor’s required certifications.
The same issue applies to service providers. While the cybersecurity regulations do not apply directly to service providers, providers’ customers may ask for evidence that the provider maintains the controls required by the audit. This may result in customers requesting new or more specific information that goes beyond a standard security certification report (like a SOC 2).
Assessing the Use of Internal Auditors
The regulations allow businesses to use either an internal or external auditor but impose specific competence and independence requirements. The auditor must exercise objective, impartial judgment; rely primarily on objective evidence rather than management representations; and certify that the audit was conducted independently, objectively, and impartially.
For organizations relying on internal resources, independence and competence are likely to be challenging. For example, internal audit or security assurance teams may help design or operate the controls they later review, which could undermine their independence depending on reporting lines and responsibilities. Conversely, an internal audit function may be independent but lack the technical expertise needed to assess a cybersecurity program that spans both technical controls and governance issues.
Businesses planning to conduct the audit internally should assess both issues before the first audit cycle begins. Those engaging an outside auditor may also benefit from starting the selection process early, especially as demand for qualified auditors increases ahead of the first certification deadlines.