Interface of the display connected to the global people identification system.

CCPA cyber audit requirements: new attestation priorities for leaders

Authors

  • Jaime Kipnes

    EY Global and Americas Technology Risk Cybersecurity Leader

  • Brandon Miller

    EY Global and Americas Technology Risk System and Organization Controls, Attestation and Certification Leader

6 minute read 21 Oct 2026

CCPA cyber audit rules are in effect. Covered organizations should define scope, evidence processes and auditor independence now.

In brief
  • CCPA cyber audit rules took effect January 1, 2026. The earliest audit period begins January 1, 2027, with certification due April 1, 2028.
  • A qualified, independent auditor must test whether the cybersecurity program is designed and operating effectively across the full audit period.
  • Leaders should confirm scope and auditor independence, map SOC 2 work to CCPA requirements, close evidence gaps and establish an executive review and certification process.

California’s Consumer Privacy Act (CCPA) cybersecurity audit regulations took effect in January 2026, moving compliance from a future consideration to an active readiness requirement for affected organizations. Covered businesses will need to comply with annual cybersecurity audits based on revenue, with the earliest certification due April 1, 2028, for an audit covering calendar year 2027. That timing matters: Organizations in the first group now have a limited window to determine applicability, define scope, engage a qualified and independent auditor, and confirm that the evidence needed to support the audit is produced consistently throughout the year.

The required cybersecurity audit is not a management assertion or a point-in-time review. An independent, qualified auditor must assess whether an organization’s cybersecurity program is designed and operating effectively to protect personal information, supported by controls with supporting evidence rather than description alone.

The California Consumer Privacy Act applies to for-profit businesses that do business in California and meet any of the following criteria:

  • A gross annual revenue of more than $26.5 million
  • Buy, sell or share the personal information of 100,000 or more California residents or households
  • Derive 50% or more of their annual revenue from selling California residents’ personal information

A senior executive responsible for the program must then certify completion to the State of California after reviewing the results. A System and Organization Controls (SOC) 2 report evaluates controls relevant to security, availability, processing integrity, confidentiality and privacy. The SOC 2 report and other assessment work can provide a strong, tested control foundation with a targeted attestation that helps address the remaining requirements. Organizations must map existing assurance work to the CCPA scope, address any gaps and avoid assuming that an existing report automatically fully satisfies the regulation.

What leaders need to know about attestation

The regulation requires more than documented policies. Covered businesses must support an independent audit with evidence gathered across the full calendar year and prepare leadership to certify completion.

  • Independent audit: A qualified, independent auditor must assess whether the cybersecurity program is appropriately designed and operating effectively — not simply confirm that controls and policies exist.
  • Evidence and certification: The audit must be supported by sufficient evidence from the full audit period. A responsible senior executive must review the results and certify completion to the State of California.
  • Act now: Confirm applicability and auditor independence; map existing SOC 2 and other assurance work to CCPA requirements; and address control, documentation and evidence gaps before the audit period begins.

How EY can help

What are the CCPA cybersecurity audit rule requirements?

Under California’s new regulations, businesses whose processing of consumers’ personal information meets the regulatory thresholds for significant risk must complete an annual cybersecurity audit. Applicability depends on factors including business size and the volume or sensitivity of personal information processed, rather than on CCPA coverage alone.

 

The independent cybersecurity audit examines how well the organization’s cybersecurity program protects personal information across a full year. It evaluates not only whether controls exist but also how consistently they operate. Typical areas of focus include authentication practices, encryption standards, access management, network security, incident response planning and the documentation that supports these controls.

 

To reinforce accountability, a senior leader must formally sign off on the completion of the annual audit. The certification confirms that the independent audit was completed and that the executive has reviewed the results. The certification is then submitted to the State of California, though the detailed audit report itself is not.

Rising expectations for executive accountability reflect the higher standards organizations are being held to for protecting personal data. These expectations are shaped by an increasingly complex cybersecurity landscape and the real impact failures can have on consumer privacy and trust

Jaime Kipnes

EY Global and Americas Technology Risk Cybersecurity Assurance Leader

Key challenges in meeting CCPA cybersecurity audit requirements

Many organizations already conduct security assessments, but under cybersecurity audit requirements in California, there are several new complexities:

Independence and qualifications of the auditorCalendar year evaluationSpecific cybersecurity audit report components
The audit must be conducted by someone who is independent of the cybersecurity program and appropriately qualified to perform the assessment. This will typically be an external audit firm. For internal audit teams who perform this assessment, this may require re-evaluating reporting lines, responsibilities and documentation to demonstrate objectivity, competence and independence.Unlike many audits that may follow a non-calendar year or shorter cycle, the CCPA audit must evaluate cybersecurity program effectiveness across the calendar year from January through December. Organizations that operate on non-calendar fiscal years may need to adjust their audit planning, evidence collection and monitoring processes to align with this requirement.The annual cybersecurity audit requires a level of transparency that goes beyond what has traditionally been seen in cybersecurity regulations, including clear disclosure of testing and sampling performed during the assessment. Reports shift the focus from evaluating control design to demonstrating operating effectiveness, requiring auditors to document tested controls, evidence reviewed, identified weaknesses and planned remediation.

How SOC 2 supports CCPA cybersecurity audit readiness

A SOC 2 examination evaluates controls relevant to security, availability, processing integrity, confidentiality and privacy. These areas, known as the Trust Services Criteria provide a structured approach for demonstrating how well systems and processes protect information. Organizations typically scope SOC 2 examinations based on relevance to their services to customers and risk profile and it is rare for a single report to include all five criteria categories.

Although a SOC 2 report does not generally provide full compliance for the CCPA cybersecurity audit requirements, it can serve as an important foundation with very strong overlap. Organizations with mature SOC programs often have:

  • Clearly documented controls
  • Well-maintained evidence trails
  • Defined control owners
  • Annual cycles of independent review

Such practices support the discipline required for the new cybersecurity audit. SOC 2 also reinforces activities like evidence management, repeatable testing and governance documentation, which are essential for demonstrating full-year compliance. To comply with the CCPA cybersecurity audit requirement, organizations may choose to have their external auditor supplement the SOC 2 work with a targeted CCPA attestation report tailored to address remaining CCPA audit requirements, reducing duplication and streamlining preparation.

By preparing early and integrating SOC 2 leading practices with targeted CCPA audit efforts, organizations build not only compliance, but confidence — they will be ready to meet regulatory demands while strengthening operational resilience

Brandon Miller

EY Global and Americas Technology Risk SOC, Attestation and Certification Leader

How to prepare for CCPA cybersecurity audit requirements

Preparing early not only supports compliance but also strengthens trust and operational resilience. Several actions can help organizations move forward confidently:

  • Evaluate independence
    Engage your external auditor or, if an internal audit team will perform the cybersecurity review, verify that reporting structures and previous advisory engagements preserve auditor independence.

  • Map existing controls to CCPA expectations
    Organizations with SOC programs can assess how existing controls align with the CCPA audit requirements to identify where further enhancements or additional control documentation may be needed.

  • Prepare for full-year audit evidence
    Collecting evidence across a complete calendar year requires intentional processes, checkpoints and coordination across cybersecurity, technology, compliance and risk teams.

  • Establish an executive certification process
    Executives responsible for signing audit certifications need structured review processes and visibility into cybersecurity performance throughout the year, in addition to reviewing the independent audit results. Establishing these processes early will help confirm accuracy and confidence.

Summary 

The CCPA cybersecurity audit requirements are now in effect, requiring covered organizations to prepare for annual independent assessment of their cybersecurity programs. Organizations should confirm applicability and auditor independence, maintain evidence of control effectiveness across the audit period, and determine how existing SOC 2 and other assurance work can support CCPA cybersecurity audit readiness.

Leaders should establish these processes before their first audit period begins. Mapping existing controls to CCPA requirements, addressing documentation and evidence gaps, and establishing an executive review and certification process can reduce duplication while strengthening cybersecurity governance and operational resilience.

Frequently asked questions about CCPA cybersecurity audits

About this article

Authors

  • Jaime Kipnes
    EY Global and Americas Technology Risk Cybersecurity Leader
  • Brandon Miller
    EY Global and Americas Technology Risk System and Organization Controls, Attestation and Certification Leader
Related topics
Assurance
Technology risk

How EY can help

Related articles

AI governance has entered its next phase: closing the confidence gap

Explore the EY AI Risk and Governance Survey for insights on AI governance, agentic AI risk, cybersecurity and closing the confidence gap.

Richard Jackson + 1

How AI vulnerability discovery is rapidly reshaping SOC reporting

SOC reporting is evolving as AI vulnerability discovery accelerates. From controls to testing and disclosures, scrutiny and expectations are rising.

Brandon Miller

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.