LexLint.ioBeta

Know the law your code answers to.

Law / United States / California

CCPA Cybersecurity Audit Regulations

Cal. Code Regs. tit. 11, Sections 7120 to 7124

In force since .

A comprehensive regime rule binding private bodies.

Criminal exposure
No
Private right of action
No
Obligation class
Security, DPIA, Reporting, Retention
Audit expectation
periodic
Who audits it
Internal independent, Independent third party
Where the report goes
Filed with regulator, Kept

What it requires

  • If your business meets the CCPA's business-scale thresholds, deriving 50 percent or more of annual revenue from selling or sharing personal information, or having more than $25 million in annual gross revenue and having processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers, in the preceding calendar year, complete a cybersecurity audit.NIST Privacy FrameworkGV.MT-P3
  • Complete that audit using a qualified, objective, independent auditor, who may be internal or external to the business, and who did not develop, implement, or maintain the cybersecurity program being audited.NIST Privacy FrameworkGV.MT-P3
  • If you use an internal auditor, have the highest-ranking auditor report to, and have their performance evaluation and compensation determined by, a member of executive management who does not have direct responsibility for the cybersecurity program.NIST Privacy FrameworkGV.MT-P3
  • Retain all documents relevant to each cybersecurity audit for at least five years, and give the audit report only to a member of executive management with direct responsibility for the cybersecurity program.NIST Privacy FrameworkGV.MT-P3
  • Submit a written certification of completion to the California Privacy Protection Agency by April 1 following each year you were required to complete an audit, starting for the largest businesses and reaching every covered business by .NIST Privacy FrameworkGV.MT-P4

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements and privacy policies are established and in place.
  • GV.MT-P4Policies, processes, and procedures for communicating progress on managing privacy risks are established and in place.
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

Who enforces it

Enforcement body

Enforced by the California Privacy Protection Agency or the Attorney General under the CCPA's general enforcement authority (Civil Code Section 1798.185); this Article states no cybersecurity-audit-specific penalty amount of its own.

What it makes you log

What the log must hold

Event time, Actor identity

Log retention

Five years after completion of the audit is a minimum for every document relevant to the audit, held by the business and by the auditor; the section states no maximum.

Unit
Years
As of
Basis
Fixed
Minimum value
5

Logging duty

A business that meets the significant-risk thresholds must have a cybersecurity audit done each year, and the business and the auditor must retain all documents relevant to each audit for a minimum of five years after it is completed (section 7122(g)). The audit report must name the auditor and carry a statement signed and dated by the highest-ranking auditor (section 7123(e)(7) and (8)), and the business also files a yearly certification of completion with the Agency (section 7124); the Agency receives that certification, not the report. Section 7123(c)(7) lists audit-log management, including the centralized storage, retention and monitoring of logs, as a component the auditor assesses where it applies; it sets no log duty on the business, so the record coded is the audit record. The sections name no one who may demand the audit documents and carry no territorial clause; the thresholds come from the CCPA's definition of a business in Civil Code section 1798.140(d), outside the row.

Kind
Explicit
As of
Provision
section 7122(g)
Trigger
personal_data_processing

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 9 of the California Privacy Protection Agency's CCPA regulations, adopted by the Agency Board on and effective , requires a business whose processing of personal information meets the CCPA's revenue-from-data-sales threshold, or its revenue threshold combined with processing the personal information of 250,000 or more consumers or households or the sensitive personal information of 50,000 or more consumers in the preceding calendar year, to complete a cybersecurity audit using a qualified, independent auditor, who may be internal or external to the business, and to submit a written certification of that completion to the Agency each year by April 1.

The underlying audit report is not filed with the Agency; the business and auditor must retain it for five years, and it goes only to an executive with direct responsibility for the cybersecurity program.

First certifications are due on a staggered schedule starting for businesses with 2026 annual gross revenue over $100 million, then for the $50 million to $100 million tier, and for smaller covered businesses, after which every covered business audits and certifies annually.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .