CCPA cybersecurity audit requirements: who, what and when

Published October 22, 2026

Under California's updated CCPA regulations, in force since January 1, 2026, businesses whose data processing presents significant risk must complete an independent cybersecurity audit every year and certify it to the California Privacy Protection Agency. The first certifications are due on April 1, 2028, 2029 or 2030, depending on revenue.

This is a plain-English summary for owners and managers, not legal advice. The regulation text and the agency's notes are linked at the end.

Who needs the audit

You're in scope if either is true:

• You derive 50% or more of annual revenue from selling or sharing consumers' personal information; or
• Your annual revenue is above the CCPA threshold ($26,625,000, adjusted periodically) and in the prior year you processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers.

Note what's missing: there's no exemption for being headquartered outside California. If you meet the CCPA's general applicability and these thresholds, the audit applies.

First deadlines

After the first one, each year's audit is certified by April 1 of the following year. The certification is signed by a member of executive management who is directly responsible for the business's compliance.

What the audit must cover

Scope is every system that collects, uses, discloses, retains or processes personal information of California consumers, plus connected systems that affect them: identity management, network infrastructure, backups. The auditor reports on the safeguards in place, which can include:

• Authentication, including multi-factor authentication and strong passwords
• Encryption of personal information at rest and in transit
• Account management and access controls, including least privilege
• Inventory and management of personal information and of hardware and software
• Secure configuration, patch management and vulnerability scanning
• Penetration testing, audit-log management and network monitoring
• Security training, vendor oversight, retention and disposal
• Incident response and business continuity

The report must describe the system, test the controls, identify gaps with a remediation plan, document any breach notifications made, and record when management reviewed it. The business also certifies that it did not influence the auditor.

Who can audit you

A qualified, objective and independent auditor. Internal auditors are allowed if they report to the board or to an executive who doesn't run cybersecurity. External firms need appropriate credentials. All follow professional auditing standards and keep their documentation.

How to prepare now

1. Count: estimate how many California consumers and how much sensitive data you processed last year, and your revenue tier. That sets your deadline.
2. Map the systems that touch California personal information. Scope surprises are the most expensive part of any audit.
3. Reuse what you have: a SOC 2 or ISO 27001 program covers much of the control list. Run a gap assessment against the CCPA components; see what SOC 2 costs and the platforms that automate it.
4. Close the basics first: MFA, encryption, asset inventory, logging. They appear in every framework, including New York's Part 500.

Sources: California Privacy Protection Agency, CCPA updates and cybersecurity audit regulations (effective January 1, 2026) · Norton Rose Fulbright, Data Protection Report. Summary as of October 2026; not legal advice.