CCPA cybersecurity audit requirements: What should privacy teams prepare now?

The latest California Consumer Privacy Act (CCPA) cybersecurity audit requirements became effective on January 1, 2026, alongside new rules for risk assessments and Automated Decision-Making Technology (ADMT). Together, they change how covered businesses document cybersecurity controls and review processing that creates significant privacy risk. 

The filing dates can make preparation look less urgent than it is. Businesses with annual gross revenue above $100 million that meet Article 9 thresholds enter their first audit period on January 1, 2027. Their first cybersecurity audit report must be completed by April 1, 2028. 

Risk assessment requirements have already started. New covered processing initiated on or after January 1, 2026 must undergo an assessment before it begins. ADMT requirements for significant decisions follow on January 1, 2027. 

During Privado AI's August 2026 webinar, Michael Spadea of FTI Consulting and Ben Werner of Privado AI explored what these deadlines mean operationally. Their discussion covered audit scope, existing security work, risk assessment volume, ADMT classification, and evidence readiness. The full session is available on demand for teams that want to hear the regulatory interpretation and see the assessment workflow demonstrated in detail.

This blog breaks down those requirements and explains what privacy teams can begin doing now rather than treating April 2028 as the starting point.

Meet the experts

Michael Spadea

Senior Managing Director, FTI Consulting

Michael brings an audit and operational risk perspective to the discussion. He explains how businesses can scope Articles 9, 10, and 11, assess existing compliance work, and prepare evidence before formal audit periods begin.

Ben Werner

Product Marketing Lead, Privado AI

Ben focuses on turning CCPA risk assessment requirements into repeatable workflows. During the webinar, he demonstrates how Wren uses processing context and documentation to populate assessments, identify evidence gaps, and surface risks for review.

Together, they connect what the regulations require with the decisions privacy teams need to make before the first compliance milestones arrive.

For additional context on California's newer assessment and ADMT rules, check out the Privado AI webinar with Hintze Law that covers the legal requirements alongside assessment automation.

What are the new CCPA cybersecurity, risk assessment, and ADMT requirements?

The final CCPA cybersecurity audit requirements create three connected compliance workstreams. Article 9 covers annual cybersecurity audits. Article 10 addresses processing that presents significant privacy risk. Article 11 governs qualifying uses of ADMT for significant decisions. 

The dates overlap, but each requirement needs different preparation. A cybersecurity audit checks whether controls work effectively. A risk assessment reviews proposed processing. Article 11 adds consumer-facing requirements when ADMT is used for significant decisions.

The webinar's central point is therefore clear: April 1, 2028 is a filing date, not a preparation date. For first-tier businesses, the Article 9 evidence period begins more than a year earlier. 

Existing covered processing also needs attention. Processing that began before January 1, 2026, and continues afterward must generally have its Article 10 assessment completed by December 31, 2027.

The broader compliance picture is covered in the CCPA compliance playbook, including risk assessments, ADMT readiness, consent enforcement, and the evidence regulators increasingly expect from businesses. 

From an enforcement-focused perspective, a recent Privado AI webinar on CCPA enforcement also explains how California's audit, opt-out, and risk-assessment requirements fit within the broader enforcement environment.

Which businesses must complete a CCPA cybersecurity audit?

One of the first questions Michael Spadea addresses is the most practical: Are we in scope for Article 9? He frames the regulation as two gateways into the cybersecurity audit requirement.

The first applies when a business meets the CCPA threshold, with at least 50% of its annual revenue coming from selling or sharing consumers' personal information.

Understanding these thresholds is the starting point for determining whether a cybersecurity audit is required. The presentation below provides a useful reference for reviewing the applicability criteria under Article 9 and related compliance obligations.

For a deeper understanding of how privacy audits work in practice, watch the full webinar featuring experts from Myna Partners and Privado AI. They walk through real-world audit findings, common compliance gaps, and practical approaches to strengthening privacy controls.

Once a business determines that Article 9 applies, the next consideration is when its first audit must begin. The regulations establish a phased implementation schedule based on annual gross revenue:

The threshold tells you when the first audit begins. It does not define the entire CCPA cybersecurity audit requirements.

Spadea cautions against treating data exemptions as organization-wide exclusions. He uses the Gramm-Leach-Bliley Act (GLBA) and the Health Insurance Portability and Accountability Act (HIPAA) as examples during the webinar. An exemption affecting specific information does not automatically exclude every system that contains other CCPA-covered personal information from consideration.

This makes system-level scoping important. Privacy and security teams need a reliable view of where covered personal information resides before defining the audit environment.

Can SOC 2 or ISO 27001 count toward the CCPA cybersecurity audit?

"Can we reuse our System and Organization Controls (SOC) 2 work?" is one of the central questions Spadea works through. The useful answer is potentially, but not as an automatic substitute for Article 9.

Existing SOC 2 or ISO/IEC 27001 work can provide a valuable starting point. It may already contain system information, control descriptions, and evidence that an auditor can reuse.

The limitation is scope. A SOC 2 engagement has defined boundaries for the examination. Article 9 separately requires the audit to evaluate the cybersecurity program and applicable control areas across the relevant information system.

The final regulations expressly allow a business to use a cybersecurity audit, assessment, or evaluation prepared for another purpose. However, that work must satisfy every Article 9 requirement on its own or through supplementation. The National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 is one example referenced by the regulations.

Spadea turns that rule into a simple reuse test:

The boundary question often creates the biggest gap. A SOC 2 audit may focus on systems supporting a particular service, whereas the CCPA audit boundary can extend to other systems that contain covered personal information.

Teams therefore do not need to discard existing security work. They need to map it against Article 9, identify what can be reused, and fill the remaining gaps before the audit period begins.

Spadea covers this reuse question in greater depth during the Privado AI audit-readiness webinar, including when existing security work needs additional scope or evidence.

Can an internal audit team conduct the Article 9 audit?

Another question Spadea addresses directly is whether businesses need to hire an external firm for the Article 9 audit. The answer is no. An internal audit function can conduct it, provided the required independence and objectivity conditions are satisfied.

This qualification creates the more difficult operational question. A team may already perform cybersecurity reviews while also advising the business on controls, procedures, or remediation. Those responsibilities can affect whether it remains sufficiently independent to perform the Article 9 audit.

For an internal auditor, the highest-ranking auditor must report directly to an executive without direct responsibility for the cybersecurity program. That executive must also control the auditor’s performance evaluation and compensation.

Spadea points to previous advisory involvement as another area teams should examine. Work such as developing procedures, preparing business documentation, or recommending cybersecurity changes can create independence concerns when the same function later audits that work.

Reporting findings does not, by itself, create the same problem. The distinction is between independently evaluating controls and helping design or implement the controls being evaluated.

This is why Spadea recommends resolving auditor independence early. Several organizations may already have an internal audit or governance, risk, and compliance (GRC) function that appears suitable, yet its reporting structure or prior advisory work could change that assessment. 

Why does CCPA cybersecurity audit readiness need to start before 2027?

Spadea frames readiness around two questions: Is the control designed properly, and can the business prove it worked?

The second question changes how teams should prepare. Article 9 states that audit findings cannot rely primarily on management assertions. Auditors need specific evidence, including documents, sampling, testing, and interviews. 

For higher-risk areas, that evidence can include access reviews, logs, or samples that show how the control operated during the audit period. A policy that looks correct on paper does not establish operational effectiveness.

This makes 2026 a crucial window for readiness. Teams can identify weak controls or missing evidence before January 2027, then address those gaps before they become formal audit findings.

Privado AI's Privacy Engineering Center of Excellence provides additional resources for connecting privacy requirements with the technical controls that operate across live products and systems.

The resulting audit report also deserves careful governance. Businesses submit a certification of completion to the California Privacy Protection Agency (CPPA) rather than routinely filing the full report. The underlying report must identify the evidence examined and document weaknesses, along with remediation plans. Audit-related documents must be retained for at least five years.

Spadea therefore recommends addressing scope and evidence gaps before the audit period starts. Enterprises should also involve counsel when determining how readiness work and audit records are governed.

When does the CCPA require a risk assessment?

Article 10 shifts the discussion from cybersecurity controls to processing risk. A business must conduct a risk assessment before beginning processing that falls within specified categories presenting significant privacy risk.

The important distinction is that automated processing is broader than ADMT. Starting with an ADMT inventory alone can therefore leave Article 10 processing outside the review. For example, automated processing that infers traits from systematic observation of workers can trigger Article 10 even without making a significant decision.

A completed assessment must then weigh privacy risks against the benefits of the processing. The analysis is not simply a label that marks an activity "high risk" and ends the review.

Privado AI's CCPA compliance playbook for 2026 provides additional context on linking assessments to actual systems and evidence, rather than relying on generic compliance documentation.

How many CCPA risk assessments does a business need?

A business does not necessarily need a separate assessment for every similar activity. Article 10 allows a single risk assessment to cover a comparable set of processing activities presenting similar privacy risks. 

This creates a useful efficiency opportunity, but the boundary needs to make sense. Privacy teams should examine the purpose of processing and the information involved, then consider whether the same technology and recipients remain relevant.

A related challenge is keeping assessments connected to current processing information. Privado AI's overview of AI agents for privacy assessments explains how documentation and data-mapping evidence can be reused rather than repeatedly collecting the same context from stakeholders. 

Can existing DPIAs or other privacy assessments be reused?

Yes. Existing assessments can provide a strong starting point, rather than forcing teams to rebuild every review from scratch. The regulations allow a risk assessment prepared for another purpose when it contains all required CCPA information. A business can also supplement that assessment with the missing information. 

A Data Protection Impact Assessment (DPIA), for example, can already document processing purposes and safeguards. It may also contain useful information about personal data and affected systems. The remaining work is to identify CCPA-specific gaps. The final regulation's example notes that information about contributors or the person with decision authority can still need to be added. 

This is where a current processing inventory becomes valuable. Privado AI's Dynamic Data Maps can bring together evidence from code, third-party software, websites, mobile apps, contracts, and documentation as processing changes.

When must a risk assessment be updated?

An assessment cannot remain static after the processing changes.

Businesses must review risk assessments at least once every three years. A material change triggers an earlier update as soon as feasibly possible, with an outside limit of 45 calendar days. A material change can include a new purpose or a change that increases an existing privacy risk. Reduced safeguards can also trigger the requirement. 

Spadea stresses that the 45 days should not become an automatic waiting period. If a product team already knows about a material change, privacy review should enter the workflow before the new processing reaches consumers.

This approach keeps the assessment useful as a decision tool rather than turning it into documentation produced after the decision has effectively been made.

This need to connect assessments with evolving systems is also addressed in the product privacy management overview, which explains why privacy checks and assessments must keep pace with software releases.

What must businesses submit to the CPPA for risk assessments?

One distinction can prevent unnecessary work: businesses do not routinely submit every full risk assessment to the California Privacy Protection Agency (CPPA).

For risk assessments conducted during 2026 and 2027, the first regulatory submission is due April 1, 2028. After 2027, businesses generally submit by April 1 following a year in which covered risk assessments were conducted.

The submission contains summary information rather than every assessment:

The executive submitter must be responsible for the risk assessment program, have sufficient knowledge of the underlying work, and have authority to make the submission.

The assessments remain with the business unless requested. If the CPPA or California Attorney General requests them, the business must provide them within the required 30-day period.

This distinction also explains why the quality of the evidence matters before filing begins. A clean summary cannot compensate for weak underlying assessments if the regulator later requests a review of them.

The earlier CCPA assessment webinar also covers the annual reporting requirement and the practical work privacy teams need behind the submitted summary.

What counts as ADMT under the CCPA?

Automated Decision-Making Technology is not limited to sophisticated artificial intelligence. The regulation defines ADMT as technology that processes personal information and uses computation to replace or substantially replace human decision-making.

As Spadea puts it during the webinar, teams should think of Article 11 as a decision-making rule rather than an AI rule. A complex AI model is not automatically covered, while comparatively simple technology can qualify if it replaces human decision-making. 

The webinar provides a useful classification path:

The same workflow also helps teams avoid missing Article 10. An automated process that falls outside Article 11 can still trigger a risk assessment.

When does human review change ADMT requirements?

Adding a human reviewer does not automatically remove a system from ADMT requirements. What matters is whether that person plays a meaningful role in the decision. The regulations require the reviewer to understand the automated output, consider the information, and have the authority to make or change the decision.

The webinar illustrates this with a mixed workflow. If a system approves applicants but sends denials to a human reviewer, denials receive human review while approvals can still depend entirely on automation. Privacy teams therefore need to assess the decision path rather than label the system as “human reviewed.”

A human appeal works differently. When ADMT has already made the significant decision, an appeal does not change that fact. However, Article 11 can provide an opt-out exception when a qualifying human appeal is available.

Spadea works through this distinction in the Privado AI audit-readiness webinar, including how meaningful human involvement changes the Article 11 analysis.

What notices and consumer rights apply to ADMT?

Once Article 11 applies, classification is only the starting point. Before January 1, 2027, covered businesses need consumer-facing processes that explain how ADMT is used. A Pre-use Notice must describe the specific purpose of the technology rather than relying on broad language about automated decisions.

The notice should also explain applicable opt-out rights and the consumer’s right to access ADMT information. If the business relies on a qualifying human appeal rather than offering an opt-out, the notice must explain how that appeal works.

Consumers can also request information about how the ADMT affected them. The response should explain its purpose, relevant output, and role in the significant decision. Privacy teams therefore need reliable input from product owners and vendors to support notices and access responses.

What should privacy teams prioritize before the first deadlines?

The webinar connects Articles 9, 10, and 11 through one common requirement: reliable visibility into processing.

A privacy team needs to know what information is processed and which systems handle it. The same foundation supports audit scoping, risk assessment triggers, and ADMT classification.

1. Confirm Article 9 scope: Determine whether the cybersecurity audit thresholds apply to the business.
2. Inventory relevant systems: Identify environments that contain CCPA-covered personal information before defining the audit boundary.
3. Map existing evidence: Compare SOC 2, ISO 27001, or other work with Article 9 requirements.
4. Resolve auditor independence: Confirm the audit function before the first evidence period begins.
5. Identify Article 10 processing: Find new and existing activities that require risk assessments.
6. Classify automated systems: Separate broad automated processing from Article 11 ADMT.
7. Assign accountability: Identify contributors, processing decision owners, and executive submitters.
8. Close evidence gaps: Address weak controls and missing documentation before they become audit or assessment problems.

This sequence also limits duplicated work. A well-maintained processing inventory can support multiple compliance workflows, rather than forcing teams to rediscover the same facts repeatedly.

For organizations building that operating model, Privado AI's Agentic Assessments can connect assessment responses with evidence from documentation and existing processing context.

How does Privado AI help automate CCPA risk assessments?

Ben Werner closes the webinar by moving from regulatory requirements into a working CCPA assessment. The important shift is that the workflow starts with evidence, rather than an empty questionnaire.

Privado AI can build processing context from contracts and internal documentation. It can also use information discovered through connected systems and product scanning. For example, Web Auditor can identify live website data flows, while App Auditor provides similar visibility into mobile SDKs and app behavior.  

This broader evidence can feed a processing inventory before the assessment starts. Privacy teams then spend less time asking stakeholders to reconstruct basic facts from memory.

How does Wren identify processing activities?

During the demo, Wren reviews third-party contracts against existing processing activities, identifies vendors that are not fully represented, and recommends new activities for privacy team approval. Once approved, those records become part of the processing context used for later assessments, reducing the risk that new processing remains outside review until someone completes a questionnaire.

This same intake model can support ongoing privacy reviews as business activities change. The Meet Wren overview explains how Wren can surface new processing and help teams determine when to begin a privacy assessment.

How does Wren populate CCPA risk assessments?

Once a processing activity requires review, Wren can start the relevant CCPA assessment and use available evidence to populate responses. In the webinar demo, contract information completes much of the assessment, while unanswered fields are clearly identified for human input rather than filled with unsupported assumptions.

Reviewers can inspect the evidence behind each response and add documents or direct input where context is missing. Privado AI's Agentic Assessments product overview explains how this evidence-first approach builds assessments around actual processing instead of generic answers reused across projects.

How does Wren help teams track identified risks?

Risk identification continues after the questionnaire is complete. During the webinar, Wren surfaces potential risk scenarios from the evidence gathered during the assessment, allowing reviewers to validate them before confirmed issues move into risk tracking. Teams can then prioritize open risks and follow remediation progress.

The workflow also tracks assessment status, due dates, completion progress, and risk levels. Once an assessment is ready, teams can export supporting documentation and prepare the required submission summary. Wren organizes the evidence, while privacy teams and executives retain responsibility for review and final attestation.

What should privacy teams do next?

The April 2028 date can create a false sense of distance. For the largest qualifying businesses, the first Article 9 evidence period begins on January 1, 2027. Article 10 already applies to new covered processing in 2026. 

Privacy teams can use the remaining preparation period to confirm audit scope and review existing security work. They can also identify assessment triggers and establish clear ownership before deadlines start converging.

The larger lesson from the webinar is that compliance begins with reliable visibility. Auditors and regulators will need more than a statement that a control or assessment exists.

Organizations need evidence showing which processing occurred, what controls applied, and how risks were evaluated. That evidence also needs to remain current as products and systems change. Privado AI's Dynamic Data Maps and Wren connect processing context to assessment workflows, helping teams reuse evidence rather than repeatedly rebuild it.

Watch the full webinar to hear Michael Spadea explain the new CCPA requirements and see Ben Werner demonstrate how Privado AI can automate the risk assessment workflow.

Legal disclaimer: 

This article is for informational purposes only and does not constitute legal advice. CCPA requirements and regulatory interpretations can change. Consult qualified counsel for guidance specific to your organization.

FAQs

Who must complete a CCPA cybersecurity audit?

A business must complete a CCPA cybersecurity audit when its processing meets the significant-risk thresholds in Article 9. This can include businesses that derive at least 50% of their annual revenue from selling or sharing personal information. It can also include qualifying businesses that meet specified thresholds for consumer- or sensitive-information processing. 

When is the first CCPA cybersecurity audit due?

The first audit report is due April 1, 2028 for qualifying businesses with more than $100 million in 2026 annual gross revenue. Their audit covers the period beginning January 1, 2027. Lower revenue tiers begin later, with first reports due in 2029 or 2030. 

Can SOC 2 satisfy the CCPA cybersecurity audit requirements?

SOC 2 work can contribute to Article 9 compliance, but it does not automatically satisfy the CCPA cybersecurity audit requirements. Existing audits can be reused when they meet all Article 9 requirements, either directly or by supplementation. Businesses should compare coverage, system boundaries, and supporting evidence before relying on previous work. 

Can an internal auditor conduct a CCPA cybersecurity audit?

Yes. Article 9 permits internal auditors when they remain qualified, objective, and independent. The highest-ranking internal auditor must report to an executive who does not have direct responsibility for the cybersecurity program. Previous work designing or implementing the controls being audited can also create independence concerns that the organization should resolve before assigning the audit.

Which activities require a CCPA risk assessment?

Article 10 covers six categories of processing. They include selling or sharing personal information, processing sensitive personal information, and using ADMT for significant decisions. Certain automated inferences and technology-training activities are also covered. Specified exceptions apply, so privacy teams should assess the actual processing rather than relying on a broad project label. 

Can one CCPA risk assessment cover multiple processing activities?

Yes. One CCPA risk assessment can cover a comparable set of processing activities when those activities are similar and create similar privacy risks. The regulation provides an example of recurring marketing activities that use the same data, collection method, technology, and purpose. Materially different processing can require a separate assessment or update. 

What is the 45-day rule for CCPA risk assessments?

A material change requires the risk assessment to be updated as soon as feasibly possible and no later than 45 calendar days. Material changes include developments that create new negative impacts or increase existing risks. The deadline is an external limit, not a recommended waiting period before review begins. 

What qualifies as ADMT under the CCPA?

ADMT is technology that processes personal information and uses computation to replace or substantially replace human Decision-Making. Article 11 focuses on ADMT used for significant decisions. A system does not need sophisticated artificial intelligence to qualify. Its role in the Decision-Making process is more important than the technology label. 

Does human review mean a system is not ADMT?

Not automatically. A qualifying human reviewer must understand the technology's output and consider other relevant information. That person must also have authority to make or change the decision. If human involvement does not meet those conditions, the automated system can still fall within the CCPA's ADMT definition. 

What must businesses submit to the CPPA by April 1, 2028?

For risk assessments conducted during 2026 and 2027, businesses submit specified summary information and an executive attestation by April 1, 2028. The submission includes assessment counts, relevant data categories, reporting-period information, and submitter details. Businesses do not routinely file every underlying risk assessment with the agency.