Some annual traditions involve turkey. California’s newest involves an independent cybersecurity audit, 18 program components, a full year of evidence, and an executive who certifies to the state under penalty of perjury. Then you do it again next year.
For companies with more than $100 million in 2026 revenue, the first 12-month audit period opens January 1, 2027. The regulations are long. The path through them is shorter than it looks.
Step 1: Are you in? Two questions decide it.
- Are you a CCPA “business”? If you’re a for-profit company doing business in California with more than $26,625,000 in gross annual revenue, very likely yes.
- Does your processing present a “significant risk” to consumers’ security? The regulations turn that phrase into numbers: 50% or more of your annual revenue in the preceding year came from selling or sharing personal information, OR your gross annual revenue in that year exceeded $26,625,000 AND the business processed the personal information of 250,000 or more California consumers or households, or the sensitive personal information of 50,000 or more. Employees and business contacts count. So does California data outside GLBA, if you’re a financial institution.
Two yeses? Congratulations, you’re in.
Step 2: Now what?
- Figure out what’s actually being audited. The audit looks at your cybersecurity program as it protects personal information. Pin down the program and the systems in scope, and write down why anything is out.
- Pick your auditor before anyone else. The auditor can be internal or external but must be independent: a firm that helps design or fix your program can’t audit it, this year or later. Choose your auditor of record first, then bring in help around it.
- Hand off the heavy lifting. Counsel can retain a cybersecurity advisory firm to manage the project, assess your program, and help close gaps, so your team supplies access and answers instead of taking on a second job. We can also discuss bringing the advisory firm in before your audit period opens. A gap it finds and fixes now is an improvement. From there, we keep the firm on for quarterly control checks during the audit period, so problems surface while there’s still time to fix them and you build a record that your controls held up all year.
- Get the audit, and a plan for the findings. The auditor delivers the required report, and your executive signs knowing what’s behind the signature. Counsel advises on how to address the findings, so next year’s audit shows gaps that were recognized and handled.
Then it repeats: Every year. There’s a point to doing the first cycle well: it’s where you build the process (owners, evidence routines, a review calendar) that makes the second one less painful.
What to do before January 1 (ideally now): If you had more than $100 million in 2026 revenue, your audit period opens in about eight weeks. Use them the way the tip above suggests: settle on your auditor of record, then bring in counsel and an advisory firm to find and fix what you can before January 1. At the same time, start generating evidence. Logs, tickets, training records, and test results need to exist for the whole audit period, because the auditor can’t rely mainly on management’s say-so.
