This is part two of a four-part series highlighting key learnings from the IAPP Privacy. Security. Risk. + AI Governance Global conference.

California's new cybersecurity audit requirements were among the most practical issues discussed in Seattle. Several sessions, including CCPA Article 9: Preparing for a New Kind of Audit, addressed the work companies need to undertake before their first audit periods begin.

Under 11 CCR Section 7120, the requirements apply to CCPA-covered businesses that derive at least half their annual revenue from selling or sharing personal information, or that meet the CCPA revenue threshold and process personal information about at least 250,000 consumers or households, or sensitive personal information about at least 50,000 consumers. In my experience, a lot more companies are in scope of these audits than currently realize.

Important to note: the relevant processing and sale or sharing thresholds are measured in the preceding calendar year, not the current/upcoming year. 

The requirements phase in as follows:

These revenue tiers establish the phase-in dates for businesses that otherwise meet the audit criteria. The applicable revenue is measured in the year preceding the start of the relevant audit period. Annual audits continue after the first audit cycle.

Businesses must complete and retain their cybersecurity audit reports and submit an executive certification of completion to the California Privacy Protection Agency (CPPA). The certification must be signed by an executive management team member under penalty of perjury. The full audit report is not typically submitted.

Existing SOC 2 reports, ISO certifications, and other assessments may support the process, but shouldn't be treated as automatically satisfying California's requirements.

The audit must evaluate implementation and effectiveness, supported by testing and other evidence rather than management assurances alone. The regulations require auditor independence, although the auditor may be internal or external. I spoke with several companies trying to figure out how and whether they can handle the audit with existing internal resources, while still maintaining the proper separation to complete a truly independent audit. Businesses and their auditors must retain relevant audit documentation for at least five years after completion.

For businesses in the first revenue tier, the audit period begins Jan. 1, 2027 — just a few short weeks away. That makes it important to address scoping, auditor independence, and evidence collection procedures before the end of this year, even though the regulations don't separately mandate that those preparation steps be completed by Jan. 1.

California's separate risk assessment regulations already apply to covered processing activities. Assessments of covered processing that began before 2026 and continues must be completed by Dec. 31, 2027. The first summary submissions and executive attestations for assessments conducted during 2026 and 2027 are due April 1, 2028.

Businesses must maintain the underlying assessments and provide them within 30 calendar days if requested by the CPPA or California Attorney General.

Practical Takeaway

Determine now whether your company is covered and which audit period applies. For businesses entering the 2027 cycle, establish audit scope, confirm auditor independence, and begin collecting evidence of control operation. Pay particular attention to access reviews, security testing, identified deficiencies, and remediation.