CCPA cybersecurity audits: are you ready for April 2028?

Which businesses must meet the CCPA cybersecurity audit requirements?

A business subject to the CCPA must meet its cybersecurity audit requirements and complete an annual audit when its processing of personal information presents significant risk to consumers' security. Article 9 of the CCPA regulations (Cal. Code Regs., tit. 11, §§ 7120 to 7124) defines that risk with two tests, and meeting either one is enough.

The first test is revenue mix: the business derived 50 percent or more of its annual revenue in the prior calendar year from selling or sharing consumers' personal information. Few professional firms meet it. The second test is the one that matters for most of s90's readers. It applies to a business that meets the CCPA's gross revenue threshold, $26,625,000 as of November 2026 after the CPPA's January 1, 2025 adjustment, and that in the prior calendar year processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers.

Sensitive personal information under the CCPA includes Social Security numbers, account numbers paired with access credentials, precise geolocation and health information, among other categories. A firm that holds tax returns, account applications or HR files can reach 50,000 records faster than its leadership expects, especially once former clients, prospects and departed employees are counted.

When is the first audit due, and what period does it cover?

The first certifications are due April 1, 2028, and the audit behind them covers calendar year 2027. The California Privacy Protection Agency's announcement of the final regulations, which took effect January 1, 2026, set three phase-in dates by annual gross revenue:

• More than $100 million: first certification due April 1, 2028, for an audit of January 1, 2027 through January 1, 2028.
• $50 million to $100 million: first certification due April 1, 2029, for an audit of calendar year 2028.
• Less than $50 million: first certification due April 1, 2030, for an audit of calendar year 2029.

After April 1, 2030, every business that meets the significant-risk test completes an audit each year, with the certification due April 1 for the year just ended. The practical point for a firm in the first tier is timing. The audit period opens on January 1, 2027, so the logs, access reviews, training records and test results an auditor will sample need to exist from that date forward. Evidence that was never generated cannot be recreated in March 2028.

What does the audit have to examine?

The audit assesses the business's cybersecurity program, meaning its policies, procedures and practices that protect personal information from unauthorized access. Section 7123 lists 18 components, and the auditor assesses each one the auditor deems applicable to the business's size, complexity and processing. The list reads like a mature control framework:

• Authentication, including multi-factor authentication and strong passwords.
• Encryption of personal information at rest and in transit.
• Account management and access controls, including least privilege.
• An inventory of personal information and the systems that hold it.
• Secure configuration of hardware and software.
• Vulnerability scans, penetration testing and vulnerability disclosure.
• Audit-log management, network monitoring and network defenses.
• Antivirus and antimalware protection, segmentation, and limits on ports, services and protocols.
• Threat awareness, plus security education and training for staff with system access.
• Secure development practices, oversight of service providers and contractors, retention and disposal, incident response, and business continuity and disaster recovery.

Firms already working from the CIS Controls will recognize nearly every item. The 56 safeguards in CIS Implementation Group 1 map closely to this list, which makes CIS a reasonable organizing framework for audit evidence. The regulations also let a business rely on an audit it prepared for another purpose, such as an assessment against the NIST Cybersecurity Framework 2.0, as long as that audit meets every Article 9 requirement on its own or with supplemental work.

The written audit report must describe the systems and criteria assessed, the evidence examined, the gaps and weaknesses found, the business's plan to address them, and any breach notifications the business made during the period. Section 7122 adds a hard rule: no finding may rely primarily on management's assertions. Findings must rest on documents reviewed, sampling and testing performed, and interviews conducted.

Who can perform the audit?

The CCPA cybersecurity audit must be performed by a qualified, objective and independent professional using procedures and standards accepted in the auditing profession. Under section 7122(a), the auditor may be internal or external, but must be free of influence from the business's owners, managers and employees.

The independence test has a direct consequence for firms that outsource IT. Section 7122(a)(2) says the auditor must not take part in activities the auditor may assess, including developing procedures, preparing the business's documents, making recommendations about the cybersecurity program, or implementing or maintaining that program. The managed IT provider that runs your security stack is doing exactly those things, so it cannot also be your auditor. An internal auditor works only if the highest-ranking auditor reports to an executive who has no direct responsibility for the cybersecurity program, and that executive sets the auditor's evaluation and pay.

The business must give the auditor all relevant information it requests, disclose relevant facts in good faith, and keep all documents related to each audit for at least five years after completion. The auditor must keep them for the same period.

Who signs the certification, and what does it say?

The certification is signed by a member of executive management who is directly responsible for the business's audit compliance, knows the audit well enough to answer accurately, and has authority to submit it. Section 7124 requires that person to file a written certification on the Agency's website by April 1.

The certification names the business and a point of contact, states that the audit was completed, gives the audit period by month and year, and includes an electronically signed attestation under penalty of perjury. That attestation also declares that the business has not tried to influence the auditor's decisions or assessments. For an RIA or broker-dealer, the natural signer is often the COO or CCO, but the regulation leaves that choice to the firm. The audit report itself goes to the executive with direct responsibility for the cybersecurity program, which may be a different person.

Does the GLBA exemption take financial firms out of scope?

Only partly: the GLBA exemption covers certain data, so a financial firm can still be in scope for the audit. Civil Code section 1798.145(e) exempts personal information handled subject to the Gramm-Leach-Bliley Act. The exemption follows the data. Client financial records may sit outside the CCPA, while employee, applicant, prospect and website data stay inside it. Our piece on how far the GLBA exemption reaches covers that split in detail. Whether an advisory firm crosses the audit thresholds depends on its revenue and on how much non-GLBA personal information it holds. The counsel review list below covers what to bring to that decision.

What should you do this quarter?

This quarter, decide whether the firm is in scope and start building the evidence the 2027 audit period will need:

• Confirm whether the firm is a CCPA business, then count consumers, households and sensitive records outside any GLBA-exempt data set for calendar 2026.
• Identify your revenue tier and write down the resulting audit period and certification date.
• Choose an auditor who is independent of whoever runs your security program, and ask what criteria and evidence they will expect.
• Map your current controls to the 18 components and note which ones have no evidence trail today, such as access reviews, log retention or backup restore tests.
• Name the executive who will sign the certification, and coordinate with the CCPA risk assessment timeline, which reaches its first April 1, 2028 attestation on the same day.

What should your counsel review before January 1, 2027?

Counsel should review scope, the GLBA split, auditor independence and the certification signer before the 2027 audit period opens on January 1, 2027, or as soon as your 2026 revenue and record counts are available. Bring these decisions and documents:

• Whether the firm is in scope, under the significant-risk tests in section 7120(b) of the CCPA regulations and the business definition in Civil Code section 1798.140(d). Bring 2026 gross revenue figures and your counts of consumers, households and sensitive personal information records.
• Which data sets fall under the GLBA exemption in Civil Code section 1798.145(e). Bring a data inventory showing which systems hold client financial records and which hold employee, applicant, prospect and website data.
• Whether a proposed auditor meets the independence test in section 7122(a) of the CCPA regulations. Bring the engagement letter, a list of any other services the auditor provides to the firm, and, for an internal auditor, the reporting line and who sets that auditor's evaluation and pay.
• Who signs the certification under penalty of perjury, under section 7124 of the CCPA regulations. Bring the org chart and the names of the executives responsible for audit compliance and for the cybersecurity program.

How can s90 help?

If you are not sure whether the audit applies to your firm, or whether your evidence would hold up once an independent auditor starts sampling 2027 records, that is where s90 helps. Through Complete IT, s90 builds and operates the controls an auditor will test, produces the evidence on request within 24 hours under our service agreement, which also includes 72-hour breach notification, and keeps the logs, access reviews and restore tests the audit period requires. Each quarter we deliver a report showing those controls are working and review it with you. Our services support your firm's own internal policies. They are not an audit or a certification, and because we run that program, the regulation requires a separate independent auditor, to whom we hand the evidence. If you want to know whether the audit applies to your firm and what your evidence gaps look like before January 1, 2027, we are glad to walk through it with you.