CCPA Cybersecurity Audit: The 18 Components and the 2028 to 2030 Deadlines
California now requires an annual, independent cybersecurity audit when a business’s processing presents significant risk to consumers’ security. Here is who is in scope, what the auditor tests and when you certify.
An audit built on evidence, not management’s word
Findings must rely primarily on evidence, such as documents, sampling, testing and interviews, rather than management’s assertions. The auditor may not design, recommend or run the program being audited.
What the CCPA cybersecurity audit requires
Article 9 of CalPrivacy’s regulations (11 CCR §§7120 to 7124), in force since January 1, 2026, requires an annual cybersecurity audit for businesses that meet the significant-risk thresholds. The audit assesses how your cybersecurity program protects personal information from unauthorized access, destruction, use, modification or disclosure, and from loss of availability.
A member of executive management then certifies to CalPrivacy, under penalty of perjury, that the audit was completed. The report itself stays with the business; prepare it as if a regulator will read it.
Who must complete the audit
from selling or sharing consumers’ personal information in the preceding calendar year.
and, in the preceding calendar year, the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers.
Not in scope? The duty to maintain reasonable security still applies, and the 18 components below are a useful reference when you plan your controls.
When your first audit is due
| First audit report due | If your annual gross revenue was | The audit covers |
|---|---|---|
| April 1, 2028 | More than $100 million in 2026 | January 1, 2027 to January 1, 2028 |
| April 1, 2029 | $50 million to $100 million in 2027 | January 1, 2028 to January 1, 2029 |
| April 1, 2030 | Under $50 million in 2028 | January 1, 2029 to January 1, 2030 |
| Every year after | You meet the criteria on January 1 | The next 12 months; report and certification due April 1 of the following year |
The 18 cybersecurity components, where applicable
Authentication
MFA, including phishing-resistant MFA for staff and vendors, and strong unique passwords.
Encryption
Personal information encrypted at rest and in transit.
Account management and access controls
Least privilege, limited privileged accounts with just-in-time access, monitored account creation and physical access.
Inventory and management
Data maps, classification and tagging, hardware and software inventories, allowlisting and approvals.
Secure configuration
Updates, on-premises and cloud hardening, masking of sensitive data, patching and change management.
Vulnerability management
Internal and external scans, penetration testing and vulnerability disclosure.
Audit-log management
Centralized storage, retention and monitoring of logs.
Network monitoring and defenses
Intrusion detection and prevention, bot detection and data loss prevention.
Antivirus and antimalware
Protection on endpoints and servers.
Segmentation
Separating systems with properly configured firewalls, routers and switches.
Ports, services and protocols
Limiting and controlling what is exposed.
Cybersecurity awareness
Keeping current on changing threats and countermeasures.
Education and training
For everyone with system access, for example at the start, yearly and after a breach.
Secure development
Secure coding practices, code reviews and testing.
Vendor oversight
Service providers, contractors and third parties held to their contracts.
Retention and disposal
Retention schedules and secure disposal of data no longer needed.
Incident response
A documented plan and testing of response capabilities.
Business continuity and disaster recovery
Recovery plans, data recovery and backups.
The auditor decides which components apply to your systems and may assess others. See what IT must show for each component
Who can perform the audit
Qualified
Knowledge of cybersecurity and of how to audit a cybersecurity program, using accepted auditing procedures and standards, such as those from the AICPA, PCAOB, ISACA or ISO.
Objective and independent
Internal or external, but free from influence. The auditor must not develop procedures, prepare the business’s documents, make recommendations about the program (other than findings) or implement or maintain it.
Internal auditors
The highest-ranking auditor reports directly to an executive without direct responsibility for cybersecurity, and an executive without that responsibility handles the auditor’s evaluation and pay.
What the audit report must contain
| # | Required content (11 CCR §7123(e)) |
|---|---|
| 1 | A description of the information system, the policies and practices assessed, the criteria used and the specific evidence examined, with an explanation of why they justify the findings |
| 2 | The applicable components, how the business implements and enforces them, and how effective they are |
| 3 | Gaps and weaknesses that increase the risk to consumers’ personal information, described in detail |
| 4 | The business’s plan to address those gaps, with a timeframe |
| 5 | Corrections or amendments to prior audit reports |
| 6 | The titles of up to three qualified individuals responsible for the cybersecurity program |
| 7 | The auditor’s name, affiliation and qualifications |
| 8 | A signed, dated statement from the highest-ranking auditor certifying independence and objectivity, and that findings did not rely primarily on management’s assertions |
| 9 | Sample copies or descriptions of breach notices sent to consumers |
| 10 | Sample copies or descriptions of required notices to agencies, with dates, details and remediation |
Keep all documents relevant to each audit for at least five years. An audit prepared for another purpose, such as one based on NIST CSF 2.0, can count if it meets every requirement, on its own or with supplements.
What you submit to CalPrivacy by April 1
Who signs
A member of executive management who is directly responsible for audit compliance, knows the audit well enough to give accurate information and has the authority to submit.
What it includes
The business name and a contact, a statement that the audit is complete, the period covered by month and year, and the signer’s name, title and date.
The attestation
Signed under penalty of perjury, including a statement that the business did not try to influence the auditor’s decisions. Submitted through CalPrivacy’s website.
Readiness or the independent audit: one role per program
| Service | What you get | When |
|---|---|---|
| CCPA cybersecurity readiness assessment | Read-only gap assessment against the 18 components, evidence inventory, risk-rated findings and a prioritized roadmap | Before your first audit period starts |
| Independent CCPA cybersecurity audit | Evidence-based testing, findings for each applicable component and a report structured around 11 CCR §7123; management documents its own plan for the gaps, and your counsel confirms the audit meets the regulation | During or after the audit period, from an auditor that did not advise on, build or maintain your program |
An audit finding from a sample report
- Component
- 07 · Audit-log management
- Finding
- Firewall logs are overwritten after 7 days and nothing is stored centrally
- Severity
- High
- Evidence
- Firewall logging is local only with 7-day rotation. Microsoft 365 audit logs are kept at the 180-day default and never exported. A sample of 25 network events from the first half of the audit period could not be reconstructed.
- Management’s plan
- Centralize firewall and Microsoft 365 logs, set 12-month retention and review alerts weekly. Owner: IT manager. Target: next quarter.
The audit in four numbers
first audit reports due for businesses with more than $100 million in 2026 revenue
Source: 11 CCR §7121(a)(1)components the audit must assess, where applicable
Source: 11 CCR §7123(c)consumers or households (or 50,000 for sensitive data) that bring larger businesses into scope
Source: 11 CCR §7120(b)(2)minimum retention for all audit documents
Source: 11 CCR §7122(g)Page 8 of 10: CCPA cybersecurity audit
- 1. CCPA and CPRA compliance (hub)
- 2. CCPA vs CPRA explained
- 3. Does the CCPA apply to your business?
- 4. Consumer rights and privacy requests
- 5. Penalties, fines and lawsuits
- 6. Implementation roadmap
- 7. CCPA for IT administrators
- 8. CCPA cybersecurity audit (this page)
- 9. Risk assessments and ADMT
- 10. CCPA compliance checklist
Guided by Ali Hassani, CISSP, C|CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, who has earned dozens of Microsoft and Cisco certifications over his career, including MCSE, MCITP, MCSA Security, CCNP and CCNA. OC Security Audit performs read-only cybersecurity assessments and audits built on evidence, and takes one role per program, readiness advisor or independent auditor, as the regulation’s independence rules require. Legal interpretation stays with your privacy counsel.
Questions business owners and IT leaders ask
Can our IT provider or MSP be the auditor?
Not if it designs, recommends, implements or maintains the program being audited. The regulation bars those activities for the auditor.
Can an internal auditor do it?
Yes, if qualified and independent. The highest-ranking auditor must report directly to an executive without direct responsibility for cybersecurity, and an executive without that responsibility handles the auditor’s evaluation and pay.
Do we send the audit report to CalPrivacy?
No. You submit a certification of completion by April 1. Keep the report and related documents for at least five years.
Can a SOC 2 or NIST audit count?
An audit prepared for another purpose can count if it meets every requirement of Article 9, on its own or with supplements. The regulation names NIST CSF 2.0 as an example.
What if we are not in scope?
You still have a duty to maintain reasonable security. The 18 components, written for in-scope audits, are a useful reference when you plan your controls.
General information, not legal advice
This page summarizes California privacy law and regulations as of October 2026 to help businesses plan their cybersecurity and IT work. It is general information, not legal advice. It does not create an attorney-client relationship and does not guarantee compliance or any outcome. OC Security Audit is a cybersecurity firm, not a law firm. Confirm how the CCPA applies to your business with qualified California privacy counsel. Enforcement examples summarize the regulators’ public announcements; settlements can resolve allegations without an admission of wrongdoing. Laws, regulations and inflation-adjusted amounts change, so check the primary sources below.
Primary sources · Last reviewed October 2026
- CalPrivacy: text of the CCPA regulations on cybersecurity audits, risk assessments and ADMT (effective January 1, 2026)
- CalPrivacy: CCPA updates, cybersecurity audit, risk assessment and ADMT rulemaking
- CalPrivacy: updated monetary thresholds in the CCPA (effective January 1, 2025)
- California Civil Code, Title 1.81.5: California Consumer Privacy Act
Start readiness before your audit period does
Schedule a consultation. We help you gather the facts your counsel needs to confirm scope, agree on our role, and map the time left before your first audit period.
Read-only reviews. Irvine, Orange County and Southern California on-site; remote nationwide.