Your first California cybersecurity audit report is due in April 2028.
That date is a distraction. The period the auditor examines opens in about three months.
Every control you want credit for has to be running, and leaving a trail, from the first day of that period. A control you switch on in April 2027 has no record for the first quarter the auditor examines.
Who is in the first CPPA cybersecurity audit wave, and which revenue year decides it?
Revenue alone does not put you in scope. Two tests stack.
The first is the risk test in section 7120. A business must complete a cybersecurity audit when its processing "presents significant risk to consumers' security," and 7120(b) defines that as either of two things:
- You meet the Civil Code 1798.140(d)(1)(C) threshold in the preceding calendar year: you derive "50 percent or more of its annual revenues from selling or sharing consumers' personal information."
- You meet the 1798.140(d)(1)(A) revenue threshold (annual gross revenues "in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95"), and in the preceding calendar year you either processed the personal information of "250,000 or more consumers or households" or processed the sensitive personal information of "50,000 or more consumers."
The second test is timing. Section 7121 sorts in-scope businesses into waves by revenue. The first wave is 7121(a)(1): a report due "April 1, 2028, if the business's annual gross revenue for 2026 was more than one hundred million dollars ($100,000,000) as of January 1, 2027."
So the revenue year that decides the first wave is 2026, the year you are in now. The $50M to $100M band is measured on 2027 revenue with a report due 1 April 2029. Under $50M is measured on 2028 revenue with a report due 1 April 2030.
Ticket: have finance confirm 2026 gross revenue against the $100M line and privacy confirm which 7120(b) limb you meet. Document both with the data source.
Why is 1 January 2027 the real deadline when the report is not due until 1 April 2028?
Read the second sentence of 7121(a)(1): "The business's audit would cover the period from January 1, 2027, through January 1, 2028."
The report is written after the fact. The evidence is generated during it.
Section 7122(d) then closes the obvious shortcut: "No finding of any cybersecurity audit may rely primarily on assertions or attestations by the business's management."
Put those two together and the planning horizon moves fifteen months earlier. An auditor sampling access reviews or restore tests across 2027 needs records from across 2027. A control that starts mid-year gives them half a population and a finding.
What breaks: teams that treat the report date as the project date. They build the program in 2027, then discover in early 2028 that the logs, tickets and review records for the first months do not exist. You cannot backfill an operating record.
Which of the 18 program components will your auditor actually test?
Section 7123(c) lists eighteen components the audit must assess "if applicable." Under 7123(b)(2), the auditor decides which apply to your information system. You do not get to pick.
Mind the scope of "information system" too. Section 7001(t) says it includes the resources organized for processing personal information "regardless of whether the business owns those resources." Your SaaS estate and hosted infrastructure are in.
Most of the eighteen are standard hygiene: patching, scanning, logging, training, incident response. Five carry the longest lead times. Start them in Q4 2026:
| 7123(c) component | Verbatim anchor | Evidence that must exist from 1 Jan 2027 |
|---|---|---|
| (1)(A) Authentication | "multi-factor authentication that is resistant to phishing attacks for employees, independent contractors, and any other personnel, service providers, and contractors" | IdP enrollment reports by factor type, including third-party and contractor accounts; exception register |
| (2) Encryption | "Encryption of personal information, at rest and in transit" | Per-store encryption configuration exports mapped to the PI inventory; TLS configuration scans |
| (3)(B) Privileged access | "using a privileged-access management solution (e.g., to ensure just-in-time temporary assignment of privileged access)" | PAM session and elevation logs; privileged account list with owners and review sign-offs |
| (4)(A) PI inventory | "maps and flows identifying where personal information is stored, and how it can be accessed" | Versioned data map with change history, plus classification and tagging rules |
| (18) BC/DR | "Business-continuity and disaster-recovery plans, including data-recovery capabilities and backups" | Dated restore tests, backup job logs, plan review records |
Phishing-resistant multi-factor authentication is the one that bites. It extends to service providers and contractors. Vendors reaching PI through shared accounts or SMS codes are a 2027 finding waiting to be written.
What evidence will the auditor accept, given findings cannot rest on management assertions?
Section 7122(d) names what findings must rest on: "the specific evidence (including documents reviewed, sampling and testing performed, and interviews conducted) that the auditor deems appropriate."
The report has to show that evidence too. Under 7123(e)(1), the cybersecurity audit report must identify "the specific evidence examined to make decisions and assessments" and "explain why" that evidence justifies the findings.
Audit evidence that survives sampling has three properties:
- System-generated. IdP, PAM, backup and ticketing exports, not a typed spreadsheet.
- Dated inside the period. Timestamps that fall between 1 January 2027 and 1 January 2028.
- Complete. The auditor samples the full population, not your best three.
Ticket: for each of the five components above, name the system of record, the export, the owner and the retention location. Run one mock sample in December 2026 to prove the export works.
Can the team that builds your program in Q4 2026 also be your auditor?
No. This is the second trap, and it has to be solved now, not in 2027.
Section 7122(a)(2) allows the auditor to be "internal or external to the business." It then bars the auditor from "developing procedures, preparing the business's documents, making recommendations regarding the business's cybersecurity program (separate from articulating audit findings), or implementing or maintaining the business's cybersecurity program." That applies to activities "the auditor may assess in the current or subsequent cybersecurity audits."
Your Q4 2026 readiness work is exactly that list. Whoever writes the MFA procedure or stands up the PAM tool cannot audit it.
If you use internal audit, 7122(a)(3) adds a reporting line test. The highest-ranking auditor must report directly to an executive "who does not have direct responsibility for the business's cybersecurity program," and that executive sets the auditor's compensation and runs any performance evaluation.
What breaks: the helpful internal auditor who spends Q4 advising on control design. That is a recommendation regarding the program. Decide now who builds and who audits. If you are lining up an audit firm, keep their advisory arm out of the build.
Can you reuse a NIST CSF 2.0, SOC 2 or ISO 27001 audit?
Partly, and only on the Article's terms.
Section 7123(f) says a business "may utilize a cybersecurity audit, assessment, or evaluation that it has prepared for another purpose, provided that it meets all of the requirements of this Article, either on its own or through supplementation." The one example it gives is an audit that "uses the National Institute of Standards and Technology Cybersecurity Framework 2.0 and meets all of the requirements of this Article."
SOC 2 and ISO 27001 are not named. Neither satisfies the Article automatically. Either can count if it meets every requirement, alone or supplemented.
Check your existing engagement against the gaps that usually matter:
- Period. Does it cover 1 January 2027 to 1 January 2028, or a fiscal year that straddles it?
- Scope. Does it cover all personal information processing, including resources you do not own?
- Components. Does it test all applicable 7123(c) items, including phishing resistance for contractors and PI maps and flows?
- Report contents. Does it carry the 7123(e) items: gaps described in detail, the remediation plan "including the timeframe," breach notification samples and the signed auditor independence statement?
- Independence. Does the firm meet 7122(a)(2) for this business?
Map each control and evidence item to its 7123 component once, then reuse it. That is where risk and control mapping pays for itself.
What does the executive sign on 1 April 2028, and what must be retained for five years?
Two deliverables land on 1 April 2028: the report under 7121(a)(1), and a certification of completion under 7124.
Section 7124(b) requires the certification "no later than April 1 following any year that the business is required to complete a cybersecurity audit." It is submitted to the California Privacy Protection Agency via its website, by an executive who is "directly responsible for the business's cybersecurity-audit compliance."
The attestation is not a formality. Under 7124(d)(4), the executive signs "Under penalty of perjury under the laws of the state of California" that the information is true and correct "and that the business has not made any attempt to influence the auditor's decisions or assessments regarding the cybersecurity audit."
If your build team shaped the auditor's findings in 2027, your executive signs over it in 2028.
Then retention. Section 7122(g): "The business and the auditor must retain all documents relevant to each cybersecurity audit for a minimum of five (5) years after completion of the cybersecurity audit." For the first wave, that runs from completion of an audit covering 2027.
Ticket: set a retention hold on the evidence locations you named above, starting 1 January 2027.
The Q4 2026 checklist
- Confirm 2026 gross revenue against $100M and the 7120(b) limb you meet. Document both.
- Name the auditor now and fence them off from all build work under 7122(a)(2).
- Roll out phishing-resistant multi-factor authentication to employees, contractors and service providers.
- Confirm encryption at rest and in transit for every store in the PI inventory.
- Put privileged access behind a PAM solution with logged elevation.
- Version your PI maps and flows so changes are dated.
- Run and record a restore test before year end.
- For each component, name the evidence export, owner and retention location. Mock-sample it in December.
At Aigis GRC every obligation, including all eighteen 7123(c) components, is traced to a verbatim quote from the legal text, across 295+ regulations in 34 jurisdictions. Controls and evidence map once on the platform and reuse wherever they apply. The audit pack is a query, not a project.
Answer once. Assess everything. → agrc.ai
FAQ: CPPA cybersecurity audit
If my business earned over $100M in 2026, am I automatically in the first wave?
No. Section 7121(a)(1) sets timing. You must also meet the 7120(b) significant-risk test: the 1798.140(d)(1)(C) sale-or-share threshold, or the (d)(1)(A) revenue threshold plus the 250,000 consumer or 50,000 sensitive-PI volume.
What period does the first cybersecurity audit report cover?
For the over-$100M wave, 7121(a)(1) states the audit "would cover the period from January 1, 2027, through January 1, 2028," with the report due 1 April 2028.
Does the auditor have to be an external firm?
No. Section 7122(a)(2) allows internal or external auditors, provided they stay out of building, recommending or running the program. Internal auditors also need the 7122(a)(3) reporting line.
Will our SOC 2 report satisfy the CPPA cybersecurity audit?
Only if it meets all requirements of the Article, on its own or through supplementation, per 7123(f). The regulation names only a NIST CSF 2.0 audit as an example, and even that must meet every requirement.
