Starting in 2027, California businesses and companies handling California consumer data must comply with new CPPA regulations requiring annual cybersecurity audits, privacy risk assessments, and automated decision-making technology disclosures.
What You Need to Know
The California Privacy Protection Agency (CPPA) has finalized new regulations that fundamentally change cybersecurity and privacy requirements for businesses. These rules introduce three major compliance areas: annual cybersecurity audits for organizations meeting certain data processing and revenue thresholds, privacy risk assessments for businesses engaged in high-risk processing activities, and automated decision-making technology (ADMT) disclosures for AI and algorithmic decision systems.
These requirements affect both California companies and those doing business in the state. Here’s what organizations need to know about each mandate.
1. Annual California Cybersecurity Audits Are Now Mandatory for Many Businesses
The CPPA mandates annual cybersecurity audits for organizations that process personal information for 250,000+ California residents or households, handle sensitive personal information for 50,000+ California consumers, or derive 50% or more of annual revenue from selling or sharing personal information.
Audit Requirements
The audit must be conducted by a qualified, independent auditor with demonstrated cybersecurity knowledge. Audits should align with NIST Cybersecurity Framework 2.0, AICPA Cybersecurity Risk Management Reporting Framework or ISO standards. Auditors assess policy documentation, technical controls, incident response procedures, and evidence of ongoing risk management.
The audit process goes beyond simple compliance checking. It provides organizations with an objective assessment of their security posture and helps identify vulnerabilities before they can be exploited. Many businesses find that the audit preparation process itself strengthens their overall cybersecurity program by forcing documentation of controls, clarification of responsibilities, and systematic review of security measures.
Key Compliance Deadlines
- Effective date: January 1, 2026
- First certifications due: April 1, 2028 (for businesses over $100M revenue)
- Phased deadlines: Through 2030 for smaller organizations based on revenue thresholds
Organizations need to inventory systems, document controls, and conduct gap assessments. Companies that begin preparation now will have time to address findings methodically rather than rushing to meet deadlines.
2. Privacy Risk Assessments for High-Risk Data Processing
The CPPA requires privacy risk assessments for businesses handling sensitive personal information, engaging in targeted advertising to minors, using ADMT for significant consumer decisions, or training ADMT systems.
Risk assessments must document processing purposes, weigh benefits against consumer privacy risks, outline mitigation strategies, and identify designated personnel responsible for review and approval. Assessments must be updated every three years or within 45 days of any material change.
Key Deadlines
- Effective date: January 1, 2026
- First submissions: April 1, 2028 for covered entities
3. Automated Decision-Making Technology (ADMT) Compliance
Organizations using AI or algorithms for significant decisions about employment, credit, housing, or insurance must provide plain-language notices before using ADMT, offer meaningful information about the technology’s logic and impacts, and allow consumers to opt out in certain situations.
Key deadline: Compliance required January 1, 2027.
How to Prepare for California’s Cybersecurity Audit Rules
Organizations should begin by determining whether they meet compliance thresholds through data inventories and processing activity reviews. Critical preparation steps include gathering:
- Policy documents
- Penetration test results
- Vulnerability assessments
- Incident response plans
- Encryption protocols
Mapping cybersecurity programs to recognized standards such as NIST Cybersecurity Framework 2.0, CIS Controls v8.1, or AICPA/ISACA frameworks will strengthen security posture and facilitate compliance. Organizations should also consider establishing a cross-functional compliance team that includes representatives from IT, legal, compliance, and business operations to provide comprehensive oversight of preparation efforts.
Learn More About our Cybersecurity Frameworks
How BPM Can Help with California’s Cybersecurity Audit Rules
BPM’s cybersecurity team helps organizations prepare for audits, conduct risk assessments, and build privacy programs and/or attest to NIST, ISO, Privacy frameworks. Services include:
- Cybersecurity readiness assessments
- Audit preparation support
- Privacy risk assessment development
- ADMT compliance guidance
- Framework alignment with NIST, AICPA, and ISO standards
Contact BPM to discuss how cybersecurity and assurance services can help your organization meet California’s new requirements.
