California’s new cybersecurity audit requirements – Are you ready?

New cybersecurity audit requirements under the California Consumer Privacy Act (CCPA) establish a recurring, independent assessment of certain organizations’ cybersecurity programs, with the first audit period beginning January 1, 2027. We discuss which organizations may be subject to the requirements, key considerations on audit scope and independence, and how existing cybersecurity, risk, and assurance activities can support readiness. For more on California’s cybersecurity audit requiremen...