How do you choose an independent CCPA cybersecurity auditor?

What are the CCPA auditor independence requirements?

The CCPA auditor independence requirement means your cybersecurity auditor must be qualified, objective and independent, and can sit inside the business or outside it. Section 7122 of the CCPA regulations (Cal. Code Regs., tit. 11) sets those three tests, and the auditor has to use procedures and standards accepted in the auditing profession.

Qualified means the auditor knows cybersecurity and knows how to audit a business's cybersecurity program. The regulation describes knowledge rather than a specific credential, so the selection question is whether a candidate can show both halves: technical depth in controls such as authentication, encryption, logging and backup, and audit discipline in sampling, testing and documenting evidence.

Objective and independent means the auditor exercises impartial judgment on everything in scope and stays free of influence from the business's owners, managers and employees. For most firms, independence is the test that narrows the field.

Which businesses need to pick an auditor, and by when?

A CCPA business must complete a cybersecurity audit if its processing presents significant risk to consumers' security under section 7120, and first certifications are due April 1, 2028, 2029 or 2030 depending on revenue. The California Privacy Protection Agency set the phase-in by annual revenue when it finalized the regulations, which took effect January 1, 2026:

• More than $100 million: first certification due April 1, 2028.
• $50 million to $100 million: first certification due April 1, 2029.
• Less than $50 million: first certification due April 1, 2030.

Under section 7124, the certification is due no later than April 1 following the year audited. An auditor tests evidence from that year, so a firm in the first tier is choosing an auditor whose work will reach back across 2027. Engaging one early lets the auditor tell you what evidence they expect before the year is half gone.

For RIAs, broker-dealers and insurance agencies, scope also turns on the GLBA exemption in Civil Code section 1798.145(e), which covers data handled under the Gramm-Leach-Bliley Act and leaves employee, applicant, prospect and website data in play. Our piece on how far the GLBA exemption reaches covers that split.

Can our managed IT provider be our auditor?

Your managed IT provider cannot audit a security program it builds or runs. Section 7122 bars the auditor from participating in activities it may assess, and the examples it lists are developing procedures, preparing the business's documents, making recommendations about the cybersecurity program (separate from stating audit findings), and implementing or maintaining the program.

That list describes ordinary managed IT and managed security work: writing the incident response plan, configuring multi-factor authentication, maintaining backups, advising on what to fix next. A provider doing that work for you is assessing its own output if it also audits. The same logic applies to a security consultant who wrote your written information security program or a compliance firm that drafted your policies.

Your provider still has a role. It can gather and produce the evidence the auditor requests, answer the auditor's questions and remediate findings. Keeping those roles separate is what the regulation is built around.

Can we use an internal auditor instead?

Yes, an internal auditor can perform the CCPA cybersecurity audit if the reporting line meets section 7122. The highest-ranking auditor must report directly to a member of executive management who has no direct responsibility for the cybersecurity program, and that executive conducts the auditor's performance evaluation and determines the auditor's compensation.

Test your own structure against that rule. If your COO owns IT and also supervises the person who would audit it, the structure does not fit. A firm with a separate internal audit or risk function that reports to a different executive, or to someone without security duties, has a workable path. Document the reporting line before the audit year starts, and make sure the relationship works that way in practice.

What standards should the auditor follow?

The auditor must follow procedures and standards accepted in the auditing profession, such as those provided or adopted by the American Institute of Certified Public Accountants, the Public Company Accounting Oversight Board, ISACA or the International Organization for Standardization. Section 7122 names those bodies as examples.

In practice, ask each candidate which standard will govern the engagement and how that standard handles independence, sampling and documentation. A CPA firm will likely point to AICPA attestation standards. An IT audit firm may work from ISACA guidance. Either can fit, and the engagement letter should name the one being used.

The evidence rule matters as much as the standard. Section 7122 says no finding may rely primarily on assertions or attestations by management. Findings rest on documents reviewed, testing and sampling performed, and interviews. An auditor whose process is a questionnaire your team fills out is unlikely to meet that bar.

What should the engagement letter cover?

An engagement letter for a CCPA cybersecurity audit should set out the scope, the auditing standard, the auditor's independence and records retention. The regulation sets duties on both sides, and the engagement letter is where you make them concrete:

• The audit period and the components of the cybersecurity program in scope under section 7123.
• The auditing standard the auditor will follow.
• A list of every other service the auditor or its affiliates provide to your firm, with a statement of how each one avoids the activities section 7122 prohibits.
• The auditor's access to information and people. Section 7122 requires the business to provide all relevant information the auditor requests, disclose relevant facts in good faith, and not misrepresent anything.
• Delivery of the written audit report to the executive with direct responsibility for the cybersecurity program, as section 7122 requires.
• Retention of audit documents for at least five years after the audit, an obligation that applies to both the business and the auditor.

Keep in mind what the certification says. The executive who files it under section 7124 attests under penalty of perjury, and the attestation includes a statement that the business has not tried to influence the auditor's decisions or assessments. Any pressure on findings or scope would make that statement untrue.

What questions should you ask candidate auditors?

Ask candidate auditors questions that test independence, method and fit for a firm your size. Use these in the first conversation:

• What other work have you done for us, or for our IT provider, in the past three years?
• Which professional standard will govern this engagement, and who on your team holds the relevant audit credentials?
• How will you test each component, and how will your findings rest on documents, testing and sampling rather than our management's own statements?
• Have you audited firms of our size and type, and how will you scale the components listed in section 7123 to our environment?
• What evidence do you expect us to keep from the first day of the audit year?
• How will you handle findings we dispute?

What should you do this quarter?

As of November 2026, the first audit year for firms with more than $100 million in revenue (2027) is close, so make the scoping and selection decisions while there is still time to collect evidence:

• Confirm whether the firm meets the significant-risk test in section 7120 and note your revenue tier and first certification date.
• List everyone who currently develops, implements or maintains your security program, including your IT provider and consultants. None of them can audit it.
• Decide between an internal and external auditor, and if internal, document the reporting line, evaluator and compensation authority.
• Request proposals from two or three external candidates and use the questions above.
• Name the executive who will receive the report and the executive who will sign the certification, and align the audit calendar with the CCPA risk assessment timeline, which reaches its first attestation on April 1, 2028.
• If you already work from a control framework such as the CIS Controls Implementation Group 1 safeguards, share your control mapping with candidates so their test plan starts from what you have.

The scope and independence decisions above depend on your own contracts, structure and data. The counsel review list below names each decision and what to bring.

What should your counsel review before the audit year starts?

Do this review before you sign an auditor's engagement letter, and no later than the start of your first audit year (2027 for firms with more than $100 million in revenue). Bring these decisions and documents:

• Whether the firm is in scope under the significant-risk test in section 7120(b) and, for financial firms, the GLBA exemption in Civil Code section 1798.145(e). Bring prior-year revenue, record counts by consumer, household and sensitive data type, and your data inventory.
• Whether a candidate auditor is independent under section 7122. Bring the candidate's list of other services to your firm and to your IT provider, and your current IT and security contracts.
• Whether an internal auditor's reporting line meets section 7122. Bring the org chart, the auditor's job description and the records showing who evaluates the auditor and sets the auditor's pay.
• Who will sign the certification under section 7124. Bring the proposed signer's role description and the plan for delivering the audit report to the executive responsible for the cybersecurity program.

How can s90 help?

If you are not sure your security program would hold up when an independent auditor tests a full year of evidence, that is the gap to close before the audit year opens. Because s90 builds and runs security programs, we would not be your CCPA auditor, and the regulation's independence rule is the reason. Through our CCPA compliance service we can help you prepare: build and operate the controls an auditor will test, keep the logs, access reviews and restore tests the audit year needs, and produce evidence for your auditor within 24 hours under our service agreement, which also includes 72-hour breach notification. If a second set of eyes on your shortlist or your evidence gaps would help, we are glad to talk it through.