The California Privacy Protection Agency (CPPA) finalized regulations in July 2025 that came into force on January 1, 2026, implementing the California Privacy Rights Act (CPRA) cybersecurity audit and risk assessment requirements under the California Consumer Privacy Act (CCPA)—the first such requirements among US state-level privacy laws. 

These new obligations have phased compliance deadlines starting in 2028 for larger companies. A common misconception is that companies can wait until 2028 or later to start preparing—but data collection for audits needs to cover the prior calendar year. 

This article overviews the significantly stricter regime for how covered businesses will assess and validate their data protection programs under the CCPA, and shares the three top reasons why it makes sense to begin preparing for CCPA compliance well in advance of your certification deadline. 

Key takeaways

• The CCPA now requires covered businesses to submit a data privacy risk assessment with executive attestation to regulators before starting any high-risk data processing activity. 
• If their data processing activities present “significant risk to consumers’ security,” covered businesses must complete a detailed cybersecurity audit.
• High-risk data processing activities include selling or sharing Californians’ personal data, processing sensitive personal data, engaging in certain targeted advertising and profiling activities, processing data of residents under 16, and training automated decision-making tools on Californians’ data.
• Over a year of preparation and data collection proceeds submitting an audit report.
• US states have formed a privacy enforcement consortium for joint actions against violators.

What are the CCPA cybersecurity audit and risk assessment requirements and compliance deadlines? 

The CCPA now mandates two new compliance obligations:

1. Effective January 1, 2026, covered businesses must complete and submit a risk assessment with executive certification/attestation to the California Privacy Protection Agency (CPPA) before starting any high-risk data processing activity. Risk assessments for activities already underway before 2026 must be submitted by December 31, 2027.
   
   Firms must review and update their risk assessment at least every 3 years, or within 45 days of initiating any significant change in a high-risk data processing activity. Risk assessment summaries and certifications are due annually by April 1 for the preceding calendar year per the start dates below. The CPPA or other enforcement authority can request a full risk assessment at any time, usually with 30 days’ notice or less. 
2. Effective as of the dates below, a covered business must complete a cybersecurity audit if its processing of California residents’ personal data “presents significant risk to consumers’ security.” Significant risk is deemed to be present whenever a business meets either or both of these conditions:
   1. It obtains 50% or more of its annual revenue from selling or sharing California consumer or household personal data; or
   2. The organization met the annual revenue threshold (approximately $26.625 million with adjustments for inflation) for the prior calendar year, and within that year processed either:
      1. The personal data of 250,000 or more California consumers or households, or
      2. The sensitive personal data of 50,000 or more California consumers. 

The CCPA audit must be conducted by a qualified, independent auditor. However, the CPPA need receive only their attestation, not the full audit report.

While many organizations may already conduct cybersecurity audits for certification, compliance, and/or governance purposes, the CCPA audit requirements are highly specific and may not be met even by rigorous independent audits like an ISO 27001 certification or SOC 2 report. 

The CCPA cybersecurity and risk assessment compliance/certifications deadlines are tiered by annual revenue:

What businesses are covered under the new CCPA rules?

The CCPA applies to for-profit companies that do business in California (with or without a physical office in the state), collect California residents’ personal data, and meet one or more of these criteria:

• The business derives 50% or more of its annual revenue from selling or sharing California residents’ personal data.
• The business buys, sells, or shares the personal data of 100,000 or more California residents, households, or devices per year.
• The business had a gross annual revenue greater than $26.625 million (adjusted for inflation) in the prior calendar year.

What data processing activities are deemed high-risk?

According to the CCPA, a covered business must conduct a risk assessment before it engages in any of these high-risk processing activities on California residents’ personal data:

• Selling or sharing personal data.
• Processing sensitive personal data (e.g., biometric identifiers, health records, financial records, political or religious affiliations, etc.).
• Processing personal data to support targeted advertising.
• Processing personal data to support certain profiling activities.
• Processing the personal data of residents known to be under 16.
• Processing personal data to train automated decision-making tools.

Top 3 reasons to start preparing now for CCPA cyber compliance

Here are three compelling business reasons to start preparing now for CCPA cyber compliance:

1. Over a year of preparation and data collection is required to submit an audit report by your deadline date.
2. CCPA enforcement is already intensifying, and US states have formed an enforcement consortium that could compound noncompliance liabilities. 
3. Starting now can reduce noncompliance risk as well as cybersecurity risk. 

Details on these three considerations follow.

Reason 1: The 2028 submission deadline really starts in 2027.

Many firms mistakenly believe they can wait until 2028 or later to start preparing for CCPA compliance. But the regulations require an annual cybersecurity audit, and the audit must evaluate the effectiveness of the cybersecurity program using evidence-based testing conducted over the prior calendar year. The audit report must be completed and signed before management can certify compliance to the CPPA. 

So, for instance, organizations with less than $50 million in annual revenue will need to certify cybersecurity compliance based on an audit period beginning January 1, 2029. Firms subject to the April 1, 2028 deadline will need to be actively auditing their cybersecurity controls as of January 1, 2027.

Reason 2: Enforcement is already intensifying and other jurisdictions are “piling on.” 

California has been ramping up CCPA enforcement and extracting large penalties for noncompliance. Recent cases—notably fining General Motors $12.75 million in May 2026 for violating data minimization mandates—show that CCPA noncompliance can lead to civil sanctions, private lawsuits, and multi-state legal actions. 

GM’s settlement with the California Attorney General was followed by a class action lawsuit and coordinated enforcement actions by a consortium of other US states.

This climate of intense enforcement increases noncompliance risk for organizations that delay CCPA preparation—while operating with lax controls in the current threat environment also escalates cybersecurity risk.

Reason 3: Starting now reduces both CCPA noncompliance and overall cybersecurity risk.

Perhaps the most important reason to focus on CCPA cyber compliance now is so your business will have time to conduct a preliminary assessment and strategically mitigate any issues before making submissions to the CPPA. Then you can approach your first formal audit expecting regulators to receive a favorable report. 

Otherwise, there may be significant noncompliance risk and enforcement exposure with little time to remediate it prior to disclosure.

Addressing potential compliance issues in advance of your first CCPA cybersecurity audit can also strengthen your cybersecurity and privacy posture. This can help reduce the occurrence and severity of data breaches and other cyber incidents that could bring follow-on regulatory scrutiny as well as severe financial and reputational damage.

Frequently asked questions

What are the triggers for a CCPA cybersecurity audit?

A: Covered businesses must audit their cybersecurity posture if their data processing presents a “significant risk” to California consumers or households. This is typically triggered by 1) obtaining 50% or more of total annual revenue from selling California consumers’ data, or 2) An annual revenue greater than $26.625 million plus processing personal data from 250,000 or more California consumers or sensitive data from just 50,000 California consumers. 

Are SMBs exempt from CCPA cybersecurity audits?

A: SMBs are not automatically exempt from CCPA cybersecurity audits based just on their size. Audits are required regardless of size if the business presents a “significant risk” to California consumers as noted above.

Might an SMB be subject to CCPA compliance via client “flowdown” requirements?

A: Yes, an SMB can be subject to CCPA compliance through flowdown contract requirements even if they would not apply otherwise. The CCPA requires covered entities to include strict data privacy terms in its third-party agreements. An SMB that processes California residents’ personal data on behalf of a CCPA covered entity would likely be contractually obligated to comply with the CCPA also.

When do we need to start preparing for the new CCPA cybersecurity rules?

The CCPA cybersecurity rules took effect on January 1, 2026. The initial assessment period is the 2027 calendar year. The first annual filing is due by April 1, 2028 for covered businesses with annual revenue over $100 million. Smaller firms have one or two more years to build a CCPA compliant cybersecurity program.

Can an internal team perform our CCPA cybersecurity audit?

A: CCPA audits must be independent and objective as well as qualified and following recognized auditing standards. Internal auditors can perform CCPA audits, but only if they meet all the CCPA’s specific conditions and have unrestricted access to compliance data.

Do firms with an ISO 27001 certification or SOC 2 report still need to conduct a CCPA audit?

A: Yes, a CCPA independent audit is still required—but it doesn’t need to start from scratch. The CCPA explicitly permits reuse of audits performed against trusted frameworks like ISO 27001, SOC 2 Type II, or NIST Cybersecurity Framework (NIST CSF). However, the CCPA auditor must still perform a targeted “gap assessment” to evaluate all the unique CCPA/consumer privacy specific elements not included in most general reports.

Next steps

For organizations of all sizes looking to ensure timely CCPA compliance and robust cybersecurity to protect sensitive data, CBIZ can help with a range of critical services. These include:

• CCPA cybersecurity rule applicability assessments
• CCPA cybersecurity rule readiness assessments
• Independent cybersecurity audits against CCPA requirements

To speak with a privacy expert about your CCPA compliance goals and concerns, contact CBIZ.