CCPA Cybersecurity Audit 2026: Who Must Comply, Thresholds & Deadlines

On January 1, 2026, the California Privacy Protection Agency (CPPA) brought into force regulations that add a new layer to the CCPA/CPRA: certain businesses must now complete an annual cybersecurity audit, run risk assessments, and certify completion to the regulator. If you sell into California, it is worth knowing exactly where you stand — because the rule does not apply to every website, and the details matter.

Are you even in scope?

Two things must be true at once. First, the business must be subject to the CCPA — meaning it does business in California and meets at least one CCPA coverage threshold. Simply having California visitors is not enough. Second, it must cross one of the audit-specific risk thresholds below.

Step 1 — CCPA coverage (any one of these)

• Annual gross revenue above roughly $26.6M (the figure is inflation-adjusted); or
• Buys, sells, or shares the personal information of 100,000+ consumers or households; or
• Derives 50%+ of annual revenue from selling or sharing personal information.

Step 2 — Cybersecurity-audit thresholds (revenue AND one volume trigger)

The audit obligation itself targets businesses whose processing presents significant risk: annual revenue above ~$26M and at least one of:

Below every one of these thresholds, neither the audit nor the baseline CCPA obligations apply. Most small and mid-size stores will not be in scope — but fast-growing DTC brands and data-heavy platforms should check carefully.

What the audit actually covers

The cybersecurity audit assesses your internal security program: multi-factor authentication, encryption, access management, logging and monitoring, incident response, patch management, vendor oversight, and more. It must be carried out by an independent, objective professional auditor, backed by written risk-assessment reports, with a signed certification of completion sent to the CPPA and audit evidence retained for at least five years.

Compliance timeline (first certification due)

The deadlines are phased through 2028–2030, but the underlying program work — MFA everywhere, encryption, incident response, vendor due diligence — takes time to stand up. Waiting until the certification year is how businesses end up scrambling.

Where a readiness diagnostic fits

An automated scan cannot see inside your security program, so it cannot certify the CPPA audit — that requires the independent auditor. What it can do is give you a readiness diagnostic: a first, honest look at your privacy-rights posture (the parts that are observable), plus a structured checklist of what the formal audit will demand, so you walk into it prepared instead of surprised.

• Observable privacy-rights signals: CCPA disclosures, opt-out mechanics where you sell/share data, Global Privacy Control handling, disclosed data categories.
• A gap checklist for the internal audit: the security controls to have in place before an independent auditor arrives.
• A clear scope call: are you actually in scope, and if so, on which timeline?

This article is general information, not legal advice. Coverage and thresholds depend on your specific business facts; confirm your status with a qualified professional.