{"id":7061989,"date":"2026-09-20T10:21:51","date_gmt":"2026-09-20T10:21:51","guid":{"rendered":"https:\/\/peraltafinancing.com\/accounting\/what-ccpa-covered-businesses-need-to-know-before-2027\/"},"modified":"2026-09-20T10:21:51","modified_gmt":"2026-09-20T10:21:51","slug":"what-ccpa-covered-businesses-need-to-know-before-2027","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=7061989","title":{"rendered":"what CCPA-covered businesses need to know before 2027"},"content":{"rendered":"
\n<\/p>\n
\n
<\/div>\n
by Mark Hinely \/ September 10th, 2026 <\/p>\n
If your company sells or shares California residents\u2019 personal information, there\u2019s a new compliance deadline on your calendar, and it has nothing to do with cookie banners or opt-out links. Starting January 1, 2027, businesses that meet certain thresholds under the California Consumer Privacy Act need to complete an independent cybersecurity audit every year and certify the results to the state.<\/p>\n
It\u2019s a security requirement sitting inside a privacy law. Privacy officers have owned CCPA compliance for years but may not know about their organization\u2019s latest penetration test results or be involved in setting secure application development standards. Security teams, meanwhile, have been mostly indirectly affected by California\u2019s privacy statutes and regulations. This audit requirement sits right at the seam between privacy and security responsibilities, which is exactly where confusion destabilizes productivity, erodes trust, and paralyzes decision-making.<\/p>\n
Who\u2019s in scope, and when<\/strong><\/h3>\n
Applicability isn\u2019t just about revenue; its about risk to consumers. The California Privacy Protection Agency\u2019s (CPPA) risk test considers two factors: 1) how much of a company\u2019s revenue comes from selling or sharing personal information, and 2) how much personal information it processes. For example, the audit requirement would apply to a company earning $2 million per year if 50% or more of that revenue comes from selling or sharing California residents\u2019 data. The audit requirement will also apply to a company that makes $25 million in annual revenue if that company processes the personal data of 250,000 California residents or sensitive data, such as debit card information, Social Security Number, or racial or religious data of 50,000 California residents. Companies that meet the relevant criteria in 2026 will be required to undergo an audit according to the following timeline<\/p>\n<\/figure>\n
The audit is required every year when an organization meets the criteria.\u00a0<\/p>\n
Factors that can impact whether an organization meets the audit criteria go beyond organic growth. An acquisition, a new data-sharing deal, or the receipt of new data elements that fall in the \u201csensitive data\u201d definition can pull a\u00a0company\u00a0overnight. It would be wise for organizations to monitor their data processing volume and types periodically each year.<\/p>\n
How this differs from a SOC 2<\/strong><\/h3>\n
Companies already undergoing SOC 2 or similar assessments sometimes assume this is more of the same.\u00a0\u00a0It\u2019s true that some overlap between traditional security audit frameworks exists. Specifically, the regulators have identified AICPA, NIST, and ISO 27001 as acceptable foundations, but a few things go beyond a typical SOC 2 scope.<\/p>\n<\/figure>\n
None of the California requirements are foreign to a mature security program. For example, the audit components include standards such as MFA, encryption, access controls, training, and incident response. The audit mostly forces documentation and independent verification of what is already in place.<\/s><\/p>\n
Because this requirement lives inside a privacy statute, many people assume a law firm or privacy consultant can handle it. It\u2019s a cybersecurity assessment, not a legal review. Businesses that navigate this well tend to get privacy and security talking early\u00a0instead of treating it as one department\u2019s problem.<\/p>\n
What to do now<\/strong><\/h3>\n<\/figure>\n
The audit period for the first tier starts January 1, 2027, less than a year out. The best practice is to ensure that controls that will be evaluated during the audit are already functioning by then, not assembled after the fact.<\/p>\n
If you\u2019re not sure where your business stands in relation to the California audit components or want an opinion on whether existing audit work would satisfy the CPPA\u2019s requirements, contact\u00a0Kirkpatrick Price<\/a>.\u00a0<\/p>\n
![\"\"](\"https:\/\/kirkpatrickprice.com\/wp-content\/uploads\/2026\/09\/Auditor-Insights-2-1-png.avif\")
<\/div>\n![](\"https:\/\/kirkpatrickprice.com\/wp-content\/uploads\/2026\/09\/Mark-Hinely-4-1-300x300.jpg\")
by Mark Hinely \/ September 10th, 2026 <\/p>\n![\"\"](\"https:\/\/kirkpatrickprice.com\/wp-content\/uploads\/2026\/09\/Table-1-2-png.avif\")
<\/figure>\n![\"\"](\"https:\/\/kirkpatrickprice.com\/wp-content\/uploads\/2026\/09\/Table-2-png.avif\")
<\/figure>\n![\"\"](\"https:\/\/kirkpatrickprice.com\/wp-content\/uploads\/2026\/09\/Table-3-1-png.avif\")
<\/figure>\n