The CCPA Now Requires Annual Cybersecurity Audits

The California Consumer Privacy Act (CCPA) is reminiscent of Michael Meyers, Freddie Krueger, or Ghostface in that no matter how many times you think its presence is done, it keeps coming back with more. While privacy professionals have been tracking the slow rulemaking process for some time, the newly approved regulations may have startled others, fittingly just in time for spooky season. 

These regulations include several new requirements around risk assessments and consumers’ rights to access and opt-out of the use of automated decision-making technology (ADMT), and provided illustrative guidance on implementing requirements around notice, choice, and fulfillment of consumer requests. That said, everyone’s attention is drawn primarily to the new cybersecurity audit rules.  

Businesses meeting certain thresholds as defined under the CCPA are now required to conduct annual audits of their cybersecurity program. In this article, we’ll provide background on how the regulations came to be, what’s now required of businesses, and insight into how Schellman can make your compliance efforts less spooky. 

Rulemaking from the California Privacy Protection Agency 

The CCPA, passed in 2018, was amended in 2020 by the California Privacy Rights Act (CPRA). The CPRA established the California Privacy Protection Agency, the first dedicated state privacy authority in the United States tasked with enforcing the CCPA, developing regulations, and educating consumers and businesses about their privacy rights and obligations.   

The CPRA also introduced new requirements under the CCPA, including for businesses “whose processing of consumers’ personal information presents a significant risk to consumers’ privacy or security to... perform a cybersecurity audit on an annual basis.” However, the specifics around the implementation were not provided within the amendments, and the onus for dictating the requirements was punted to the California Privacy Protection Agency with their responsibilities to develop regulations. 

The agency has been working since 2023 to define the scope of and establish the process for conducting the audit. Initial public notice of the proposed rulemaking was issued on November 22, 2024, with an invitation for public commentary extending through February 19, 2025. The regulations, approved by the agency on July 24, 2025 and subsequently by the Office of Administrative Law on September 22, 2025, are set to become effective on January 1, 2026.  

Enforcement Trends and Compliance Expectations 

California was the first US state to introduce a data breach notification law back in 2002, so it’s unsurprising that there is a focus on ensuring that organizations are proactively confirming the security of their information systems processing personal information. There has also been a recent shift in the California Privacy Protection Agency’s attention to proactive compliance, infrastructural governance, and continuous rather than reactive improvement.   

The enforcement actions from 2025 alone should be enough to make a compliance professional jump out of their skin. Tractor Supply, Honda, and Todd Snyder were all targeted for similar themes: surface-level compliance measures coupled with weak contractual safeguards and ineffective implementation.  

The evolution of technology requires more accountability towards processing activities and respect for fellow consumers’ personal information. This means that as our operations become more advanced, fast-paced, and integrated, we will have to hit a moving target of “reasonable” security.   

The In-Scope Audit Components 

You may be thinking the scope of requirements seem familiar. And although you couldn’t describe the controls as being as prescriptive as ISO 27001, the regulation does offer a list of 18 potential components and subcomponents in-scope of the audit, including but not limited to:  

• Access and authentication, including multi-factor authentication that is resistant to phishing attacks and restrictions for privileged accounts; 
• Personal information, hardware, and software inventories; 
• Secure configurations, including software updates, securing on-prem and cloud-based environments, masking, patch management, and change management; 
• Vulnerability scans, penetration tests, and vulnerability disclosure and reporting; 
• Audit log management; 
• Secure development and coding best practices; 
• Retention and disposal of personal information; 
• Cybersecurity awareness, education, and training; and  
• Incident response 

However, it is ultimately the auditor who is responsible for determining which components are or are not applicable to the business’s information system based on what is appropriate for their size and complexity and the nature and scope of its processing activities, with account for the state of the art and cost of implementation.   

Notably as well, auditors will be required to identify and describe in detail the status of any gaps or weaknesses of the applicable components, the business’ plan to address the gaps and weaknesses, and the timeframe for resolving them.  

The Threshold and Timing of Compliance 

Notably, the cybersecurity audit is only required for businesses whose processing of personal information poses a significant risk to consumers’ security.  

The California Privacy Protection Agency has defined “significant risk” as follows: 

• The business derives 50% or more of its annual revenue from selling or sharing consumers’ personal information; OR 
• The business has an annual gross revenue more than $26,625,000* in the preceding calendar year, and: 
  • Processed the personal information of 250,000 or more consumers or households in the preceding calendar year; OR 
  • Processed the sensitive personal information of 50,000 consumers in the preceding calendar year  

*Please note: this amount is adjusted every other year to reflect increases in the Consumer Price Index. You can monitor those updates here. 

If your organization meets the above criteria, the deadline for completion of your first cybersecurity audit is dependent on your revenue, as outlined below: 

Proactive Steps to Prepare for CCPA Cybersecurity Audits Now 

While the first round of audit reports is not due for another two and a half years, it is strongly recommended that organizations do not wait until 2027 or 2028 to evaluate their control effectiveness.   

Waiting until after January 1, 2028 to gauge the cybersecurity program implementation would place your organization in the three-month countdown period before your report is due. If any gaps or weaknesses are identified at that point, your organization would have to scramble to draft and execute a plan to remediate the issue.  

That scenario combined with the onslaught of other businesses rushing to conduct their audit at the last minute will lead to a lack of availability from audit firms, resulting in a recipe for professional panic. Luckily, you can prepare now and we’re here to help!  

At Schellman, we pride ourselves on helping our clients work towards their compliance goals and strengthening their security and privacy programs. We strongly believe that compliance does not belong on the back burner; like the California Privacy Protection Agency’s objectives, we aim to help our clients continuously and proactively improve their security posture to be in the best position to navigate emerging legislative requirements (all while calming fears).  

Organizations should consider proactively conducting an independent assessment against the components in 2026, to provide a level of confidence in the program when the review period begins January 1, 2027. Organizations interested in conducting a readiness assessment against the regulation can contact us today for more information on how Schellman can assist in navigating their complex security and privacy regulatory environment. 

For additional insights, check out these helpful resources:  

• What You Need to Know About the CPRA 
• Schellman AI Summit 2025 
• 5 Key Considerations When Selecting an Audit Firm