Use the section 7120 entity-level calculation to decide whether an annual CPPA cybersecurity audit is required, then prepare the independent auditor, control evidence, report, executive certification, and submission.
The final regulations became effective January 1, 2026, but first audit periods and report deadlines phase in by revenue tier from 2027 through 2030.
Structured answer sets in this page tree.
Cited legal and guidance references.
A is mandatory when a CCPA business meets either section 7120 branch in the preceding calendar year: it derived at least 50 percent of annual revenue from selling or sharing consumers' personal information, or it exceeded the CCPA's $26,625,000 annual-gross-revenue threshold effective January 1, 2025 and processed personal information of at least 250,000 consumers or households or sensitive personal information of at least 50,000 consumers. The first audit report is due April 1, 2028, 2029, or 2030 under the regulation's revenue-tier phase-in.
Document the section 7120 calculation for each CCPA business before planning the audit. Preserve the preceding calendar year, annual gross revenue, percentage derived from sale or sharing, consumer-or-household count, sensitive-personal-information consumer count, calculation method, source systems, and evidence owner. Meeting the general CCPA 100,000-consumer threshold alone does not trigger this audit; section 7120 uses its own 250,000 and 50,000 processing-volume tests unless the 50-percent revenue branch applies.
If the business is in scope, appoint an auditor with cybersecurity and audit knowledge. The auditor may be internal or external but must exercise objective and impartial judgment, remain free from business influence, and avoid designing, documenting, implementing, or maintaining activities the auditor may assess. The highest-ranking internal auditor must report to an executive who does not directly own the cybersecurity program.
The audit must assess the cybersecurity program's protection against unauthorized access, destruction, use, modification, disclosure, and loss of availability. Findings must rely primarily on specific evidence such as documents, samples, tests, and interviews, not management assertions. Give the report to the executive directly responsible for the cybersecurity program, obtain the separate executive certification, submit it to the Agency, and retain relevant audit documents for at least five years.
The security or audit-readiness owner should maintain the record, while the independent auditor controls audit procedures and findings. Connect the threshold decision to the audit period, auditor independence, tested control areas, findings, remediation, certification, submission, and retention.
As a readiness practice, review evidence at least annually and after an acquisition, major system or vendor change, security incident, or new sensitive-data use. The legal audit remains annual once required. A control inventory is not an audit: confirm that the independent auditor assessed the program, based findings primarily on specific evidence, and recorded the status of prior findings and remediation.
This US CPRA guide turns Cyber Audit Readiness Workflow into owners, evidence requests, review checkpoints, and reusable operating records in Sorena.
Turn Cyber Audit Readiness Workflow into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
"On March 29, 2023, the Office of Administrative Law approved the California Privacy Protection Agency’s regulations and filed them with the Secretary of State."
"The CPRA amended the CCPA by adding additional consumer privacy rights and obligations for businesses."
"implemented requirements for certain businesses to conduct risk assessments and complete annual cybersecurity audits"
"perform a cybersecurity audit on an annual basis"
"A Tool for Improving Privacy through Enterprise Risk Management"