Skip to content

California · CCPA · Cybersecurity audits

CCPA cybersecurity audits: who has to have one, when, and what the auditor examines

The CCPA regulations require some businesses to have an independent audit of the program that protects personal information, and to certify to the CPPA that it was done. For the top revenue band, the first audit period starts on 1 January 2027, the same day the ADMT rights take effect, and the report is due 1 April 2028.

Findings cannot rely primarily on what management asserts (section 7122(d)). The auditor needs evidence that controls ran over the audit period, so the work that counts starts before the period does. We build that evidence and fix what an audit would find. We cannot be the auditor, and the section on independence below says why.

This page is a builder’s read of the adopted regulation, with section numbers. It is not legal advice. Where we are giving our reading and not the text, it is labelled.

Tell us what you runCheck whether ADMT applies to you

Who has to complete one

Section 7120(b) gives two ways in. Both are measured on the preceding calendar year, and meeting either one is enough.

  • Way 1 Section 7120(b)(1)

    Deriving 50% or more of annual revenue from selling or sharing personal information

    Independent of company size.

  • Way 2 Section 7120(b)(2)

    Gross annual revenue above $26,625,000

    The inflation-adjusted version of the original $25 million, in force since January 2025 and revisited every two years against CPI. Generally read as total global gross revenue, not California revenue. So a company with modest California business can clear it on the strength of everywhere else.

    and at least one of these:

    • Processed the personal information of 250,000 or more consumers or households in the preceding calendar year Section 7120(b)(2)(A)
    • Processed the sensitive personal information of 50,000 or more consumers in the preceding calendar year Section 7120(b)(2)(B)

When the first report is due

Which year is yours depends on gross revenue, and each cohort is measured on revenue in a different year (section 7121(a)).

First cybersecurity audit report deadlines by revenue cohort, with the audit period each covers
First report dueWhoAudit periodSection
Businesses above $100M in 2026 gross revenue to 7121(a)(1)
In the middle revenue band on 2027 gross revenue to 7121(a)(2)
In the lowest revenue band on 2028 gross revenue to 7121(a)(3)

The revenue edges for the second and third cohorts are in sections 7121(a)(2) and (a)(3) of the adopted text.

After the first report

  • After 1 April 2030, a business that meets the 7120 criteria on 1 January of a year completes an audit covering the next 12 months, with the report due by 1 April of the following year. Section 7121(b)
  • Each year an audit is required, an executive who is directly responsible for audit compliance certifies completion to the Agency, through its website, by 1 April, with an attestation under penalty of perjury. Section 7124

What the auditor examines

Section 7123(c) lists eighteen components the audit assesses if they apply. The auditor decides which apply to your information system (section 7123(b)(2)), and the audit may go beyond the list (section 7123(d)).

  1. 1Authentication: multi-factor authentication, including phishing-resistant MFA for personnel, service providers and contractors, and strong unique passwords where passwords are used Section 7123(c)(1)
  2. 2Encryption of personal information at rest and in transit Section 7123(c)(2)
  3. 3Account management and access controls: least privilege, revoking access when a role ends, privileged accounts, monitoring new accounts, physical access Section 7123(c)(3)
  4. 4Inventory and management of personal information and the information system, including data maps, classification, and hardware and software inventories with allowlisting Section 7123(c)(4)
  5. 5Secure configuration: updates, cloud and on-premises environments, masking, security patch management, change management Section 7123(c)(5)
  6. 6Internal and external vulnerability scans, penetration testing, and vulnerability disclosure and reporting Section 7123(c)(6)
  7. 7Audit-log management, including centralized storage, retention and monitoring of logs Section 7123(c)(7)
  8. 8Network monitoring and defenses, including intrusion detection and prevention, bot detection and data-loss prevention Section 7123(c)(8)
  9. 9Antivirus and antimalware protections Section 7123(c)(9)
  10. 10Segmentation of the information system Section 7123(c)(10)
  11. 11Limitation and control of ports, services and protocols Section 7123(c)(11)
  12. 12Cybersecurity awareness Section 7123(c)(12)
  13. 13Cybersecurity education and training for everyone with access to the information system Section 7123(c)(13)
  14. 14Secure development and coding practices, including code review and testing Section 7123(c)(14)
  15. 15Oversight of service providers, contractors and third parties Section 7123(c)(15)
  16. 16Retention schedules and proper disposal of personal information no longer needed Section 7123(c)(16)
  17. 17Incident response management, including testing the incident response plan Section 7123(c)(17)
  18. 18Business-continuity and disaster-recovery plans, including backups and data recovery Section 7123(c)(18)

What has to be produced

A report from the auditor, a certification from an executive, and the documents behind both.

The audit report

Section 7123(e). It goes to an executive who has direct responsibility for the cybersecurity program (section 7122(f)).

  • A description of the information system, the policies, procedures and practices assessed, the criteria used, and the specific evidence examined, with an explanation of why that evidence supports the findings Section 7123(e)(1)
  • The applicable components, how the business implements and enforces them, and how effective they are Section 7123(e)(2)
  • Each gap or weakness that raises the risk to personal information, described in detail with its status Section 7123(e)(3)
  • The business’s plan to fix those gaps, with a timeframe Section 7123(e)(4)
  • Corrections or amendments to any earlier audit report Section 7123(e)(5)
  • The titles of up to three qualified individuals responsible for the cybersecurity program Section 7123(e)(6)
  • The auditor’s name, affiliation and qualifications Section 7123(e)(7)
  • A statement signed and dated by the highest-ranking auditor, certifying an independent review, objective and impartial judgment, and no primary reliance on management assertions Section 7123(e)(8)
  • If consumers were notified of a breach under Civil Code 1798.82(a), a sample or description of the notice Section 7123(e)(9)
  • If a California agency had to be notified of unauthorized access or loss of availability, a sample or description, the dates and details, and the remediation Section 7123(e)(10)

Around the report

  • Each year an audit is required, an executive who is directly responsible for audit compliance certifies completion to the Agency, through its website, by 1 April, with an attestation under penalty of perjury. Section 7124
  • No finding may rely primarily on assertions or attestations by the business’s management. Findings rest on specific evidence: documents reviewed, sampling and testing, interviews. Section 7122(d)
  • The business and the auditor keep all documents relevant to each audit for at least five years after the audit is completed. Section 7122(g)
  • An audit, assessment or evaluation prepared for another purpose can be used if it meets every requirement of the article, on its own or with supplementation. The text gives a NIST Cybersecurity Framework 2.0 audit as an example. Section 7123(f)

Who can do the audit, and why it is not us

The audit has to be done by a qualified, objective, independent professional. That rule decides what we can and cannot take on.

  • The audit must be done by a qualified, objective, independent professional, using procedures and standards accepted in the profession of auditing. The auditor may be internal or external. Section 7122(a)
  • The auditor must not take part in business activities the auditor may assess in the current or later audits, including preparing the business’s documents, making recommendations on its cybersecurity program (apart from stating findings), or implementing or maintaining that program. Section 7122(a)(2)
  • An internal auditor’s highest-ranking auditor reports directly to an executive who has no direct responsibility for the cybersecurity program, and that executive evaluates the auditor and sets their compensation. Section 7122(a)(3)

What ivector builds

We build the evidence an auditor will ask for and fix the gaps the report names. We do not audit, certify or attest, and we do not give legal advice or choose your auditor.

  1. 01

    Log retention and an evidence store

    Centralized log storage, retention and monitoring, with retention set on purpose. Audit documents have to be kept for five years after the audit, and logs are often the evidence, so a platform default that rolls off sooner is a decision someone should make deliberately.

    Section 7123(c)(7)Section 7122(g)

  2. 02

    Authentication and access you can show

    Phishing-resistant MFA, starting with the accounts that reach personal information and the privileged ones. Least-privilege access, and joiner, mover and leaver revocation that leaves a record. The auditor tests which method is enforced on which accounts, so we begin from that list.

    Section 7123(c)(1)Section 7123(c)(3)

  3. 03

    An inventory of personal information and systems

    Data maps, classification, and hardware and software inventories, built from your infrastructure so they stay current when the infrastructure changes.

    Section 7123(c)(4)

  4. 04

    Configuration, patching and change control in the pipeline

    Secure configuration baselines, patch tracking, change records, and scanning and code-review gates that run in CI and leave results an auditor can sample.

    Section 7123(c)(5)Section 7123(c)(6)Section 7123(c)(14)

  5. 05

    Evidence of vendor oversight

    A list of the service providers and contractors that can reach personal information, what each can reach, and the contract and review records that go with each one.

    Section 7123(c)(15)

  6. 06

    A control-by-control evidence map, then the fixes

    For each applicable component, the documents, logs, test results and access records an auditor can sample, kept current. When the report names gaps, we build the fixes that close them.

    Section 7122(d)Section 7123(e)(3)Section 7123(e)(4)

The risk assessment is the other filing in this group, with its own dates. It is covered on the CCPA risk assessment page. How an engagement starts, with a scoped readiness pass before any code, is on the ADMT compliance engineering page.

Common questions

A business that derives 50% or more of annual revenue from selling or sharing personal information, or that meets the CCPA revenue threshold and also processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers, in the preceding calendar year (section 7120(b)). That is narrower than the general CCPA business test. Counsel decides whether you are covered.

1 April 2028 for the top revenue band, 1 April 2029 for the middle band and 1 April 2030 for the lowest, with each band measured on revenue in a different year (section 7121(a)). The audit for the top band covers 1 January 2027 to 1 January 2028.

An internal auditor can qualify, but must be independent. The highest-ranking internal auditor reports to an executive with no direct responsibility for the cybersecurity program, and the auditor cannot take part in implementing or maintaining the program being audited (section 7122(a)(2) and (a)(3)).

Both the business and the auditor keep all documents relevant to each audit for at least five years after the audit is completed (section 7122(g)).

No. Section 7122(a)(2) bars an auditor from implementing or maintaining the program it audits, so the firm that builds your controls should not be the one auditing them. We build the evidence and fix the gaps. Your auditor is a separate, independent professional.

Start with what you could show an auditor today

Tell us about your stack and which of the eighteen components you are least sure you could evidence. We will tell you what we would build first. If you turn out to be out of scope, we will say so and stop.

Source for every section number on this page: CCPA regulations, Title 11 Division 6 Chapter 1, effective 1 January 2026. Not legal advice.

Tell us what you runHow an ADMT engagement runs