Privacy, Cyber & Data Strategy Advisory | California Raises the Bar: New Cybersecurity Audit and Risk Assessment Take Effect

Special thanks to summer associate Emma Markle for her assistance in writing this advisory.

On January 1, 2026, new California Privacy Protection Agency (CPPA) regulations took effect, implementing cybersecurity audit and privacy risk assessment requirements under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the CCPA). For additional background on these regulations, please refer to our prior coverage here.

Businesses that meet certain revenue or data-volume thresholds must now conduct annual cybersecurity audits and certify completion to the CPPA. Businesses that engage in high-risk processing—such as selling personal information, processing sensitive personal information, or using automated decision-making for significant decisions—must complete privacy risk assessments before starting those activities and submit annual summary attestations. Both obligations are now in effect, and the preparation window is short.

Businesses should not treat these as 2028 problems. The first audit certifications are due April 1, 2028, meaning audit periods begin as early as January 1, 2027. Risk assessments for preexisting high-risk processing must be completed by December 31, 2027. Engaging auditors, mapping data flows, documenting processing activities, and structuring assessments for privilege all take substantial lead time. The time to begin is now.

Key upcoming deadlines include:

• Cybersecurity audits: For the largest businesses subject to the requirements, the first certifications are due as early as April 1, 2028.
• Privacy risk assessments: New high-risk processing activity is subject to a risk assessment now before launch. Processing activities that began before January 1, 2026 and continue after that date must be assessed by December 31, 2027, with the initial submission of risk assessment information to the CPPA due by April 1, 2028.

Priority Action Items for Businesses in California

• Determine applicability: Assess whether the organization meets the cybersecurity audit thresholds based on revenue, data volume, or data sale revenue. Separately, identify whether your organization engages in any processing activity that triggers the risk assessment requirement.
• Identify audit deadline tier: First audit report due date based on annual gross revenue: April 1, 2028 for businesses with revenue exceeding $100 million; April 1, 2029 for businesses with revenue between $50 million and $100 million; and April 1, 2030 for businesses with revenue below $50 million.
• Designate responsible executives: Identify the executive management team members who will sign audit certifications under penalty of perjury and risk assessment submissions, and ensure they have sufficient knowledge to do so accurately.
• Conduct a gap analysis against the 18 audit components: Map existing cybersecurity programs against the 18 required audit components to identify and remediate weaknesses before the first audit period begins.
• Prepare submission infrastructure: Set up internal processes to certify cybersecurity audit completion and submit risk assessment attestations through the CPPA website by the applicable April 1 deadlines.
• Leverage existing frameworks: Evaluate whether existing compliance work (e.g., SOC 2 reports, ISO 27001 certifications, NIST CSF assessments, or GDPR data protection impact assessments) can satisfy or be supplemented to meet the new requirements.
• Engage a qualified auditor: Select an auditor (internal or external) who is qualified, objective, independent, and meets the requirements of Section 7122. The auditor must not participate in activities that compromise independence, such as developing procedures, preparing documents, or implementing the cybersecurity program.
• Conduct privacy risk assessments: For processing activities initiated before January 1, 2026, complete and document risk assessments by December 31, 2027. For any new high-risk processing activity, conduct a risk assessment before initiating the activity.
• Assess privilege and documentation strategy: Structure risk assessments to preserve attorney-client privilege where appropriate, particularly given the CPPA’s authority to request full reports on 30 days’ notice.
• Coordinate with service providers and contractors: Ensure service providers and contractors are prepared to cooperate with your cybersecurity audits and risk assessments, including making relevant information available and not misrepresenting facts.
• Establish retention policies: Ensure audit documents are retained by the business for a minimum of five years after completion. Retain risk assessments for as long as the processing continues or for five years after completion, whichever is later.

Key Compliance Deadlines

Compliance Triggers by Threshold Type

The tables below detail the timelines and thresholds for compliance with the new regulations.

Monetary and Revenue Thresholds

Data Volume Thresholds

Data Sale Revenue Threshold

Note on risk assessments: The privacy risk assessment obligation is based on processing activity, not size or volume. Businesses subject to the CCPA must conduct risk assessments if they engage in any high-risk processing activity listed in Section 7150(b), such as selling or sharing personal information, processing sensitive personal information, or using automated decision-making technology for significant decisions.

Overview of the New CCPA Cybersecurity Audits and Risk Assessments

What has changed

Previously, the CCPA required businesses to maintain reasonable security procedures but stopped short of mandating formal cybersecurity audits, audit certifications, risk assessments, or submissions. The new regulations fundamentally change the compliance landscape. Businesses should inventory their current privacy and security programs against the following new requirements:

• Annual cybersecurity audits with prescribed scope, independence standards, and 18 specific audit components.
• Certification of audit completion submitted to the CPPA under penalty of perjury.
• Preprocessing risk assessments tied to specific categories of high-risk processing activities.
• Submission of risk assessment summary information and attestations to the CPPA.
• Document retention requirements of five years for audit records and the longer of continued processing or five years for risk assessments.
• Service provider and contractor cooperation obligations for audits and assessments.

What the regulations require

The two most significant requirements are:

• Cybersecurity audits (Article 9, Sections 7120–7124): Businesses whose processing of consumers’ personal information presents significant risk to consumers’ security must conduct annual cybersecurity audits performed by a qualified, independent professional and submit annual certifications of completion to the CPPA.
• Privacy risk assessments (Article 10, Sections 7150–7157): Businesses that engage in processing activities presenting significant risk to consumers’ privacy must conduct and document risk assessments before initiating those activities, review them at least every three years, and submit risk assessment information to the CPPA for years in which risk assessments are conducted or updated.

Which businesses are subject to these regulations

A business must complete a cybersecurity audit if its processing of consumers’ personal information presents “significant risk to consumers’ security.” Under Section 7120(b), this standard is met if either:

• Data sale/sharing revenue trigger: The business derived 50% or more of its annual revenue from selling or sharing consumers’ personal information in the preceding calendar year. This trigger applies regardless of total revenue or data volume.
• Revenue plus data volume trigger: The business meets the CCPA business threshold (annual gross revenue exceeding approximately $26.6 million, per the inflation-adjusted $25 million statutory threshold) and, in the preceding calendar year, either processed the personal information of 250,000 or more consumers or households or processed the sensitive personal information of 50,000 or more consumers.

Cybersecurity Audits (Article 9, Sections 7120–7124)

Requirements overview

Businesses whose processing presents significant risk to consumers’ security must complete an annual cybersecurity audit. The audit must assess whether the business’s cybersecurity program protects personal information from unauthorized access, destruction, use, modification, or disclosure and whether the program is appropriate to the size, complexity, nature, and scope of the business’s processing activities.

Practical note: Businesses in the highest revenue tier should already be scoping their first audit, which will cover January 1, 2027 through January 1, 2028. Mid-tier and lower-tier businesses have additional time but should use it to remediate gaps—not delay preparation.

Independence and qualifications

The audit must be performed by a qualified, objective, independent professional using accepted procedures and standards. Businesses should begin the auditor selection and engagement process now because qualified auditors with cybersecurity expertise may be in high demand as deadlines approach. 

Key independence requirements include:

• The auditor must have cybersecurity and cybersecurity audit expertise.
• The auditor may be internal or external but must exercise objective and impartial judgment and be free from influence.
• The auditor must not participate in activities that compromise independence, including developing procedures, preparing documents, making program recommendations, or implementing or maintaining the cybersecurity program.
• If the auditor is internal, the highest-ranking auditor must report directly to an executive management team member who does not have direct responsibility for the cybersecurity program; that executive must conduct the auditor’s performance evaluation and determine compensation.
• Audit findings may not rely primarily on management assertions or attestations; findings must rely primarily on specific evidence, including documents reviewed, sampling and testing performed, and interviews conducted.

Required audit components

The audit must assess 18 prescribed components that span the full lifecycle of a cybersecurity program.

These components include: authentication and multi-factor authentication, encryption at rest and in transit, access controls and least privilege, data inventory and classification, secure configuration and patch management, vulnerability scanning and penetration testing, audit log management, network monitoring and intrusion detection, antivirus and antimalware protections, system segmentation, port and protocol controls, cybersecurity awareness and training, secure development practices, service provider oversight, data retention and disposal, incident response planning, and business continuity and disaster recovery.

Businesses may assess additional components and may use an audit prepared for another purpose (e.g., a NIST CSF 2.0 assessment) if it satisfies the Article 9 requirements, either alone or through supplementation.

Practical note: Organizations with existing SOC 2 or ISO 27001 programs should conduct a crosswalk now to identify which of the 18 components are already covered and which require supplementation. This can significantly reduce audit preparation costs and timelines.

Audit report contents

The audit report must document the information system assessed; the policies, procedures, criteria, and specific evidence examined; the effectiveness of each applicable component; the status of gaps or weaknesses, along with a remediation plan and timeline; corrections to prior reports; the titles of up to three individuals responsible for the cybersecurity program; the auditor’s name, affiliation, qualifications, and independence certification; and samples or descriptions of any consumer breach notifications or CPPA notifications issued during the audit period.

Compliance timeline

The regulations establish a phased timeline for the first cybersecurity audit based on annual gross revenue, as summarized in the Key Compliance Deadlines table above.

After April 1, 2030, if, on January 1 of any year, a business meets the Section 7120 criteria for the preceding calendar year, it must complete a cybersecurity audit covering the next 12 months and complete the audit report by April 1 of the following year. This establishes an ongoing annual cycle.

Reporting Obligations: Certification and Attestation

Certification of completion

Each calendar year the business is required to complete a cybersecurity audit, it must submit a written certification of completion to the CPPA. The certification is due by April 1 following any year in which the business was required to complete the audit.

Who must submit

The certification must be completed by an executive management team member who is directly responsible for the business’s cybersecurity audit compliance, has sufficient knowledge of the audit to provide accurate information, and has authority to submit the certification on behalf of the business.

How to submit

Certifications must be submitted through the CPPA website and must include the following information:

1. The business’s name and a point of contact (name, phone number, and email address).
2. A statement that the cybersecurity audit was completed.
3. The time period covered by the audit (expressed in month and year).
4. An electronically signed attestation under penalty of perjury, which must include a declaration that the business did not attempt to influence the auditor’s decisions or assessments.
5. The name, business title, and date of the person submitting the certification.

Important: The audit report itself is not filed with the CPPA as part of the certification process. Only the certification of completion is submitted. However, the CPPA or Attorney General’s Office may request records at any time, and businesses must retain all documents relevant to each audit for a minimum of five years after completion.

Cooperation of service providers and contractors

Service providers and contractors must cooperate with a business’s cybersecurity audit for personal information collected under their written contract with the business. This includes making relevant information available to the auditor and refraining from misrepresenting facts. Businesses should review vendor agreements now and, where necessary, add cooperation obligations before the first audit period begins.

Privacy Risk Assessments (Article 10, Sections 7150–7157)

Requirements overview

Unlike the cybersecurity audit, which is triggered by business revenue and data volume thresholds, the risk assessment obligation is triggered by the nature of the processing activity. Any CCPA-covered business whose processing presents significant risk to consumers’ privacy must conduct and document a risk assessment before initiating that processing.

Practical note: This is a precondition to processing, not a retrospective compliance exercise. Businesses launching new products, features, or data practices that involve any of the triggering activities below must complete a risk assessment before going live. For preexisting activities, the deadline to complete assessments is December 31, 2027, meaning businesses should be cataloging their processing activities and beginning documentation now.

Triggering processing activities

A risk assessment is required before initiating any of the following processing activities:

1. Selling or sharing personal information.
2. Processing sensitive personal information (exception: processing employees’ or independent contractors’ sensitive personal information solely for administering compensation, employment authorization, benefits, legally required reasonable accommodation, or wage reporting does not by itself trigger this requirement).
3. Using automated decision-making technology to make a significant decision concerning a consumer.
4. Using automated processing to infer or extrapolate consumer characteristics (such as intelligence, ability, performance at work, economic situation, health, preferences, behavior, or location) based on systematic observation of a consumer acting as an educational program applicant, job applicant, student, employee, or independent contractor.
5. Using automated processing to infer or extrapolate such characteristics based on a consumer’s presence in a sensitive location.
6. Processing personal information the business intends to use to train automated decision-making technology for a significant decision, or to train facial recognition, emotion recognition, or other identity verification, identification, or profiling technology.

Weighing privacy risks against processing benefits

The risk assessment must determine whether the risks to consumers’ privacy outweigh the benefits to the consumer, the business, other stakeholders, and the public. The goal of the risk assessment is to restrict or prohibit processing where privacy risks outweigh the benefits. Businesses should approach this as a substantive analytical exercise and not a checkbox because the CPPA can demand the full report on 30 days’ notice, and the assessment must demonstrate genuine weighing of risks against benefits.

Required report contents

Each risk assessment must document the purpose of the processing; the categories of personal information involved and operational details (including for automated decision-making or the logic and output of any automated decision-making technology); the specific, concrete benefits of the processing; the negative privacy impacts and their causes (e.g., unauthorized access, discrimination, dark patterns, or economic or reputational harm); planned safeguards (e.g., encryption, access controls, or privacy-enhancing technologies); a go/no-go statement on whether the business will proceed with the processing; the individuals who contributed to the assessment (excluding legal counsel who provided legal advice); and the date, names, and positions of the reviewers and approvers who authorized the processing decision.

Stakeholder involvement

Employees whose job duties include the processing activity under assessment must be included in the risk assessment process. The business may also include external parties.

Comparable sets and existing assessments

A single risk assessment may cover a comparable set of similar processing activities that present similar risks. A business may also use a risk assessment prepared for another purpose or to comply with another law, such as a General Data Protection Regulation (GDPR) data protection impact assessment, if it contains, or is supplemented to contain, the information required by Section 7152.

Compliance timeline

For processing activities that began before January 1, 2026 and continue after that date, risk assessments must be completed by December 31, 2027, with the initial submission of risk assessment information to the CPPA due by April 1, 2028. Businesses also must:

• Complete a risk assessment before initiating any new Section 7150(b) processing activity.
• Review and update existing risk assessments at least once every three years.
• Update a risk assessment within 45 calendar days after a material change to the processing activity.

Reporting Obligations: Submission and Attestation

Submission of risk assessment information to the CPPA

Businesses must submit annual summary information and attestations on their risk assessments to the CPPA. The submission requirement covers summary information and attestations only; the full risk assessment report is not submitted unless separately requested by the CPPA.

Submission deadlines

• For risk assessments conducted in 2026 and 2027, the business must submit the required information by April 1, 2028.
• For risk assessments conducted after 2027, the business must submit the required information by April 1 following each year in which the business conducted or updated risk assessments.

Required contents of the submission

1. The business name and a point of contact, including the contact’s name, phone number, and email address.
2. The time period covered by the submission, expressed in month and year.
3. The total number of risk assessments conducted or updated during the covered period, as well as the number for each category of processing activity identified in Section 7150(b).
4. Whether the risk assessments conducted or updated during the covered period involved each category of personal information and sensitive personal information identified in the CCPA.
5. An attestation under penalty of perjury declaring that the business conducted risk assessments for the applicable Section 7150(b) processing activities during the covered period and that the information submitted is true and correct.
6. The name and business title of the person submitting the information and the date of submission.

Who must submit

The submission must be completed by an executive management team member who is directly responsible for the business’s risk assessment compliance, has sufficient knowledge of the business’s risk assessments to provide accurate information, and has authority to submit the risk assessment information to the CPPA.

How to submit

Submissions must be made through the CPPA website.

CPPA authority to request full reports

Important: The annual submission is limited to summary information and attestation. However, the CPPA or Attorney General’s Office may require full risk assessment reports at any time, and the business must produce them within 30 calendar days of the request. 

Businesses should ensure their risk assessment documentation is complete and organized for potential production on short notice. Also, businesses should establish a centralized, indexed repository for all risk assessments now, and consider how to structure assessments to preserve attorney-client privilege while still meeting the substantive documentation requirements of Section 7152.

Document retention requirements

Businesses must retain all risk assessments, including both original and updated versions, for as long as the processing activity continues or for five years after completion of the assessment, whichever is later. Given the CPPA’s authority to request full reports at any time, maintaining a comprehensive and well-organized archive of all risk assessments is a practical necessity.

Service provider and contractor cooperation

Service providers and contractors must cooperate with the business’s risk assessment process for personal information collected under their written contract with the business. This includes making available all facts necessary to conduct the assessment and refraining from misrepresenting any fact necessary to conduct the risk assessment. Businesses should ensure that their contracts with service providers and contractors include provisions requiring this cooperation.

Practical Takeaway: The Time to Act Is Now

These regulations are not future obligations. The rules took effect on January 1, 2026, meaning that any business initiating a new high-risk processing activity must have a completed risk assessment before doing so. 

For preexisting processing, the December 31, 2027 assessment deadline is less than 18 months away, and the first audit certifications and risk assessment submissions follow three months later, on April 1, 2028.

Given the lead time required to strategize and solidify a compliance roadmap, engage qualified auditors, map processing activities across business units, negotiate cooperation provisions with service providers, and structure documentation to preserve privilege, businesses should treat these deadlines as requiring immediate action, not future planning.

Organizations that wait until 2027 to begin risk assessments or audit preparation risk missing regulatory deadlines and submitting incomplete or inadequate documentation to the CPPA under penalty of perjury.

Ransomware Fusion Center

Stay ahead of evolving ransomware threats with Alston & Bird's Ransomware Fusion Center. Our Privacy, Cyber & Data Strategy Team offers comprehensive resources and expert guidance to help your organization prepare for and respond to ransomware incidents. Visit Alston & Bird's Ransomware Fusion Center to learn more and access our tools.

If you have any questions, or would like additional information, please contact one of the attorneys on our Privacy, Cyber & Data Strategy team.

You can subscribe to future advisories and other Alston & Bird publications by completing our publications subscription form.