The California Consumer Privacy Act (CCPA) regulations have turned cybersecurity readiness into an enterprise evidence, governance, and accountability test.
Executive Takeaway
The central question is no longer whether an organization has cybersecurity policies and controls. It is whether the organization can prove, with evidence created in the normal course of business, that those controls operate as intended and that remediation is already underway.
Two gaps most often stand in the way: assurance work built for System and Organization Controls (SOC) 2 or International Organization for Standardization (ISO) audiences that does not map cleanly to CCPA’s specific criteria, and control inventories that lag behind how fast AI-enabled and agentic workflows are changing who touches personal information.
A Standard Already in Force
California’s cybersecurity audit regulations took effect Jan. 1, 2026, and the obligation to operate under them has already begun. The regulations establish annual audit requirements for businesses whose processing of personal information presents significant risk to consumers’ security, and they sit within a broader framework addressing risk assessments and automated decision-making technology.
For executives, boards, legal teams, privacy leaders, and chief information security officers, this is more than a compliance update. Cyber incidents and control failures are increasingly evaluated as multidisciplinary business events involving technology, data, privacy, governance, third parties, regulatory exposure, and executive accountability.
Policies, frameworks, and management assurances will not be sufficient on their own. Covered businesses need evidence that can withstand independent review, including documentation, testing, sampling, interviews, and a clear record of how identified weaknesses are being addressed.
Who May Be in Scope?
The audit requirement does not apply automatically to every organization operating in California. Applicability depends on whether a business is subject to the CCPA and meets specified revenue and personal information processing thresholds.
A business may be required to complete an annual cybersecurity audit if it derives 50% or more of its annual revenue from selling or sharing consumers’ personal information. The requirement can also apply to a business that meets the applicable CCPA gross revenue threshold and, in the preceding calendar year, processed the personal information of at least 250,000 consumers or households, or the sensitive personal information of at least 50,000 consumers.
Determining applicability is a cross-functional exercise. Legal, privacy, cybersecurity, finance, data, and technology stakeholders need to align on revenue criteria, data volumes, sensitive information, system boundaries, and the business activities that place data in scope.
The First Audit Period Opens Jan. 1, 2027
The regulations phase in certification deadlines according to annual gross revenue.
- April 1, 2028: Covered businesses with annual gross revenue of more than $100 million for 2026. The audit covers Jan. 1, 2027 through Jan. 1, 2028.
- April 1, 2029: Covered businesses with annual gross revenue between $50 million and $100 million for 2027.
- April 1, 2030: Covered businesses with annual gross revenue less than $50 million for 2028.
For organizations in the first wave, the audit period opens Jan. 1, 2027. Auditors will review the evidence generated from that date forward, not evidence assembled retroactively ahead of the April 2028 certification deadline. Treating this as a 2028 deadline rather than a January 2027 start date is the most common scheduling misstep we see.
Each time a covered business is required to conduct an audit, it must submit a written certification of completion, made by an executive with authority over the audit process. This requirement ties cyber assurance directly to named executive accountability, not only to institutional compliance.
More Than a Compliance Checklist
The audit reaches across the enterprise. Where applicable, it may assess authentication and multifactor authentication, encryption, access controls, asset and technology inventories, vulnerability management, penetration testing, logging and monitoring, third-party management, incident response, and business continuity and disaster recovery.
The auditor, internal or external, must be competent, impartial, and independent. The audit must identify cybersecurity weaknesses and explain how the business plans to remediate them, which makes the quality of the underlying evidence as important as the design of the control itself.
An audit or assessment performed for another purpose may satisfy CCPA criteria, in full or with supplementary work. That creates a real opportunity to reduce duplication, but only under specific conditions.
What Changes for Leadership
The most useful executive question is not simply “are we compliant?” It is “if our cybersecurity program were independently assessed today, could we prove our controls function as designed, using evidence captured in the normal course of business rather than built for the occasion?”
Two gaps tend to surface once businesses ask that question honestly.
The first is an assurance mismatch. SOC 2, ISO 27001, and National Institute of Standards and Technology (NIST)-aligned work were built for a different audience and a different standard. The CCPA audit is scoped specifically to personal information protection and assessed against the regulation’s own criteria. Prior assurance work can reduce duplication only where its testing already covered the same systems, the same data, and the same control objectives. Assuming it transfers without that mapping is the most common assurance gap we find.
The second is a moving target. AI-enabled workflows, agentic tools, and fragmented software-as-a-service environments are changing who touches personal information and how, often faster than control inventories and data maps are updated. An audit built on a static system inventory will miss exactly the processing activity growing fastest inside the business. Leaders need visibility not only into what is in scope today, but into how quickly that scope is shifting.
This is also where cyber regulation converges with broader enterprise concerns. Privacy, cybersecurity, AI governance, and cross-border data obligations increasingly overlap, and a weakness in one area can rapidly create legal, operational, communications, and reputational consequences elsewhere.
A Practical Readiness Agenda
Organizations that may be in scope have a narrowing window to build a defensible, repeatable audit capability before the first audit period opens. Leadership priorities should include:
- Validate whether the business is in scope and confirm the first applicable audit period.
- Appoint an executive sponsor and establish cross-functional governance for the audit process.
- Define the systems, data, business processes, vendors, and controls that fall within scope, including AI-enabled and agentic workflows.
- Assess control design and operating effectiveness, not only the existence of policies.
- Map existing SOC 2, ISO, or NIST assurance work against CCPA control objectives to identify what transfers and what does not.
- Create an evidence map connecting each control to documentation, testing results, owners, and retention practices.
- Identify material gaps, prioritize remediation, and assign accountable owners and target dates.
- Establish executive and board reporting that communicates readiness, residual risk, and remediation progress.
From Audit Preparation to Stronger Cyber Governance
The strongest response to these requirements is not a one-time audit project. It is a durable operating model for cybersecurity evidence, accountability, and continuous improvement. Organizations entering the audit period with a clear view of scope, control performance, evidence quality, and remediation ownership will be better positioned to respond to regulatory scrutiny and manage cyber risk more broadly.
That is the difference between preparing to complete an audit and building a cybersecurity program that is demonstrably ready for independent assessment at any time.
The Ankura Advantage
Ankura helps organizations determine applicability, interpret the regulatory requirements, map existing assurance work against CCPA-specific control objectives, assess controls and supporting evidence, account for AI-driven and agentic processing activity, identify readiness gaps, and prioritize remediation. The objective is a clear, defensible view of the organization’s cybersecurity posture before the audit period that opens Jan. 1, 2027.
Sources
California Privacy Protection Agency announcement; final rulemaking materials; approved regulations text
Disclaimer: This article provides general information about cybersecurity and regulatory developments and does not constitute legal advice. Organizations should consult legal counsel regarding the application of the CCPA and related regulations to their specific circumstances.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC, its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
