What to Prepare for in the Countdown to California’s New Cybersecurity Audits

California’s new cybersecurity audit requirements are nearly here. Large businesses must complete audit reports and certifications for 2027, but they should begin preaudit gap assessments now. Here’s what to prepare for as the countdown continues.

As previously discussed in our “” alert, the California Privacy Protection Agency (CPPA) has adopted , effective January 1, 2026, that require covered businesses to complete annual cybersecurity audits. For the largest businesses, audit periods begin as early as January 1, 2027, with audit reports due by April 1, 2028. With less than three months before that first audit period begins, this alert covers who must comply, what the audits require, and what businesses should be doing now.

Who’s Covered?

The regulations require businesses whose processing of personal information presents significant risk to consumers’ security to conduct cybersecurity audits so long as certain revenue and/or data-processing volume thresholds are met. Specifically, they apply to businesses that (i) derive at least 50% of their annual revenues from selling or sharing consumers’ personal information or (ii) had more than $25 million in annual gross revenues and processed the personal information of at least 250,000 consumers or households or sensitive personal information of at least 50,000 consumers in the preceding calendar year.

What’s Required?

Covered businesses may use internal or external auditors, but the auditors must be qualified, objective, and independent, and must have knowledge of cybersecurity and how to audit a business’s cybersecurity program. If a business uses an internal auditor, its highest-ranking auditor must report to a member of the business’s executive management team who is not directly responsible for the cybersecurity program.

The audit’s findings must primarily rely on direct evidence, such as documents, sampling and testing, and interviews, rather than on simple assertions by the business’s management. Additionally, upon the auditor’s request, businesses, their service providers and/or their contractors must cooperate and make available all relevant information they possess.

Auditors will be expected to assess multiple parts of a business’s cybersecurity program, including:

• Multi-factor authentication, including anti-phishing methods
• Use of strong, unique passwords
• Encryption of personal information at rest and in transit
• Account management and access controls
• Asset and data inventories, including data flows for personal information
• Secure hardware and software configurations and updates
• Internal and external vulnerability scanning and penetration testing
• Audit log management
• Network monitoring and defenses, including use of data loss prevention tools
• Antivirus and antimalware protection
• Information system segmentation
• Control of ports, services and protocols
• Secure code development and testing
• Cybersecurity awareness, education and training
• Vendor management
• Data retention and secure disposal
• Incident response management and testing
• Business continuity and disaster recovery plans

In addition to explaining how a business implements the above components, the audit report must describe the business’s information system, policies and practices, gaps and weaknesses, plans to address the gaps and weaknesses, breach notices sent to consumers or regulators, individuals responsible for its cybersecurity program, and the criteria and evidence used by the auditor. The report must also include a statement signed by the highest-ranking auditor certifying their independent review.

Key Deadlines

The deadline by which a business must complete its first audit report and submit written certification of audit completion to the CPPA depends on the following annual gross revenue thresholds:

• April 1, 2028 for businesses with 2026 annual gross revenues of more than $100 million as of January 1, 2027, with audits covering the period from January 1, 2027, through January 1, 2028
• April 1, 2029 for businesses with 2027 annual gross revenues between $50 million and $100 million as of January 1, 2028, with audits covering the period from January 1, 2028, through January 1, 2029
• April 1, 2030 for businesses with 2028 annual gross revenues of less than $50 million, with audits covering the period from January 1, 2029, through January 1, 2030

After April 1, 2030, newly covered businesses must complete audits and audit reports covering the next 12 months, and submit the written certification, by April 1 of the following year.

Next Steps for Businesses

For businesses that are covered by this regulation, the practical timeline is tight. Ideally, large businesses should begin their preaudit gap assessments now. That way, any remediation can be completed before the audit period begins on January 1, 2027. In addition, businesses that provide services to covered businesses should be prepared to cooperate with their customers’ needs as they enter this new audit phase.

Manatt’s Privacy and Data Security practice has deep experience advising clients on sensitive security issues, leading cyber investigations and building robust compliance programs. Therefore, it is well-positioned to help guide and coordinate any necessary audit preparations. More information about Manatt’s Privacy and Data Security practice can be found .