Understanding CCPA Cybersecurity Audit Requirements

The CCPA cybersecurity audit requirement, part of California’s 2025 privacy regulations, is now in effect for many organizations. In this video, Chris Lippert, director of Schellman’s privacy practice, explains who must comply, when reports are due, and how to scope the audit.

Who Must Complete a CCPA Cybersecurity Audit?

Businesses must complete the audit if they had annual gross revenue above $26,625,000 in the prior calendar year and either processed personal information for more than 250,000 consumers or households, or processed sensitive personal information for at least 50,000 consumers. The revenue threshold is adjusted for inflation every other year.

CCPA Cybersecurity Audit Deadlines

Deadlines are phased by revenue. Businesses with more than $100,000,000 in 2026 revenue must audit the period January 1, 2027 through January 1, 2028, with the report due April 1, 2028. Businesses with $50,000,000 to $100,000,000 in 2027 revenue audit from January 1, 2028 and report by April 1, 2029. Businesses under $50,000,000 in 2028 revenue audit from January 1, 2029 and report by April 1, 2030. After the first audit, organizations must repeat it annually, with reports due each April 1.

Internal or External CCPA Audits

The regulations allow internal or external auditors, provided they meet the regulation’s independence requirements. Whether an internal team qualifies depends on how your organization is structured.

How to Scope a CCPA Cybersecurity Audit

Scoping starts with your data inventories, data flows, privacy impact assessments, and risk assessment. Existing compliance reports can reduce re-testing, but most organizations find gaps in consumer, website, marketing, and employee data that their current assessments don’t cover.

The regulation defines 18 core components, including access controls, MFA, asset inventories, patch and change management, vulnerability management, penetration testing, logging, and incident response. Schellman’s crosswalk, available on our website, maps these to controls you may already maintain.

Ready to scope your CCPA cybersecurity audit? Contact us to speak with a Schellman privacy professional.