California's approved cybersecurity-audit regulation requires a business that meets the section 7120 significant-risk criteria to complete an annual cybersecurity audit. The regulation took effect on January 1, 2026, while the first audit periods and report deadlines are phased. For a business above US$100 million in 2026 annual gross revenue, the first audit period runs from January 1, 2027 through January 1, 2028, with the report due by April 1, 2028 under section 7121. The buying question is what security evidence to prepare during the audit period, including whether a penetration test is an applicable component.
Quick answer. Section 7123(c)(6) lists internal and external vulnerability scans, penetration testing, and vulnerability disclosure among cybersecurity-program components the auditor assesses if applicable. It is not a blanket rule that every covered business must buy an annual pentest. For businesses that use testing to evaluate relevant systems, Stingrai can provide human-led web, API, cloud and network penetration testing, with a scoped report, prioritized findings and included retesting that the business can make available to its independent auditor. Source: CPPA approved regulations, §§7122–7123.
This guide is for privacy counsel, security leaders, procurement teams and audit owners who need to make three separate decisions: whether the business owes a cybersecurity audit, when its first report is due, and what test evidence belongs in that audit. A penetration-testing provider can contribute technical evidence to the third decision. The regulation assigns the cybersecurity audit itself to a qualified, objective, independent professional who may be internal or external to the business. Section 7122 sets that role and its independence conditions.
First decide whether section 7120 applies
A CCPA-covered business does not enter the cybersecurity-audit program simply because it has a website, uses cloud hosting or has California customers. Section 7120(b) defines two routes by which its processing presents the significant security risk that triggers an audit. This is a business-level applicability decision, not a test-scoping exercise. The privacy or legal owner should record the preceding-year inputs and the conclusion before procurement treats the audit as a settled obligation.
Audit route | Operative test | Evidence to locate internally |
|---|---|---|
Sale or sharing revenue | The business met the Civil Code section 1798.140(d)(1)(C) threshold in the preceding calendar year. The statute describes that threshold as deriving 50% or more of annual revenue from selling or sharing consumers' personal information. | Revenue classification and the business's analysis of what activities are a sale or sharing under the CCPA. |
Revenue plus volume | The business met the adjusted annual-gross-revenue threshold in section 1798.140(d)(1)(A) and processed personal information of 250,000 or more consumers or households, or sensitive personal information of 50,000 or more consumers, in the preceding calendar year. | Revenue statement, consumer or household counting method, data inventory and sensitive-information classification. |
The numerical processing thresholds above come from section 7120; the sale-or-sharing revenue language comes from the CPPA's explanation of section 7120. The base revenue threshold in the statutory definition was adjusted to US$26,625,000 effective January 1, 2025, according to CPPA's monetary-threshold page. Because the statute adjusts monetary thresholds in odd-numbered years, the business should check the applicable adjusted amount for the year it evaluates instead of copying the original US$25 million figure into a standing policy.
A practical decision record can be short. Name the entity, the preceding calendar year, the governing threshold route, the data sources used for revenue and population counts, any assumptions that changed the result, the reviewer, and the review date. If the result is uncertain, resolve that with counsel before assigning an auditor or test budget. The record also prevents an annual security test already on the calendar from being mislabeled as proof that an audit obligation exists.
Figure 1: The section 7120 coverage decision is separate from section 7123(c)(6) test applicability; section 7121 then assigns the first report window. Source: CPPA, approved cybersecurity-audit regulations, §§7120–7123.
Coverage is not the same as the CCPA's general business definition
The audit threshold is narrower than the general CCPA business definition. The general definition can be met through revenue, population, or sale-and-sharing criteria; section 7120 selects the particular combinations above for cybersecurity-audit coverage. A company that satisfies the general business definition only because it buys, sells or shares information about a smaller population should not infer an audit duty without applying the actual section 7120 test. Conversely, a business that derives at least half its revenue from selling or sharing personal information should not stop at the revenue-plus-volume route. The two routes are alternatives. Source: CPPA §7120.
Entity structure matters. The internal assessment should identify which legal business is covered and which systems process its personal information. A parent, subsidiary or shared platform may create complicated data flows, but a tester should not decide legal coverage from a network diagram. Once coverage is confirmed, the data-flow diagram helps the security owner commission the right technical work.
Next map the audit report deadline and evidence year
Section 7121(a) uses annual gross revenue to phase the first report deadline. These amounts are rollout bands, not substitutes for section 7120's coverage test. The report and the auditor's evidence review follow the corresponding audit period.
Revenue reference | First period the audit covers | First report due |
|---|---|---|
More than US$100 million in 2026 annual gross revenue, measured as of January 1, 2027 | January 1, 2027 through January 1, 2028 | April 1, 2028 |
US$50 million to US$100 million in 2027 annual gross revenue, measured as of January 1, 2028 | January 1, 2028 through January 1, 2029 | April 1, 2029 |
Less than US$50 million in 2028 annual gross revenue | January 1, 2029 through January 1, 2030 | April 1, 2030 |
Source for each date, revenue band and audit window: CPPA, §7121(a). CPPA's public phase-in announcement confirms the same three first certification deadlines. The exact boundary at US$50 million and US$100 million should be read from the operative text during a business's own filing analysis; do not treat this editorial table as a legal determination for an entity at a boundary.
The timing affects testing procurement. A test run before the first audit period may help establish a baseline and close known findings, but it does not automatically describe the program as it operated during the audit period. A late test can leave little time to remediate and retest before the auditor completes the report. An audit owner should therefore connect planned tests to release dates, material changes and the period the auditor will examine. Those are planning choices for evidentiary value, not a frequency imposed by section 7123(c)(6).
After the first phase-in, section 7121(b) describes recurring audit-period and April 1 report timing for businesses that meet section 7120's criteria. Section 7124 separately requires the business to submit a written certification of completion to CPPA by the April 1 following a required audit year. A penetration-test report is an evidence artifact for the business and auditor; it is not that certification.
What section 7123(c)(6) actually asks an auditor to assess
The controlling sentence in section 7123(c) is: "The cybersecurity audit must assess the following components, if applicable." One listed component, paragraph (c)(6), is "Internal and external vulnerability scans, penetration testing, and vulnerability disclosure and reporting." The first sentence limits the list. Paragraph (c)(6) does not specify a pentest interval, insist on a third-party tester, or make a pentest a universal condition of the cybersecurity audit.
The auditor's task is still substantive. Under section 7123(b), the audit assesses the business's documented cybersecurity program, the listed components the auditor deems applicable to its information system, and how the business implements and enforces the program. If the business runs penetration tests on a customer portal and privileged internal systems, the auditor can examine their scopes, results and remediation. If the business has no testing for a relevant exposure, the auditor may evaluate what that omission means under the program and applicable component assessment. The regulation leaves the applicability judgment with the auditor and the business's circumstances; neither a vendor marketing page nor a generic checklist resolves it.
This distinction affects purchase orders. A request titled "CCPA required annual pentest" pre-decides a conclusion the regulation does not state. A better brief says what the business needs to learn: whether specified applications and access paths protect personal information, what method will be used, how findings will be validated, and what evidence the audit owner needs. The procurement decision may be justified by the business's risk analysis, its existing program commitments, another legal requirement, or a planned product change. Keep the reason in the project record.
Penetration test, vulnerability scan and audit are different work
The CPPA defines penetration testing as an authorized attempt to circumvent or defeat an information system's security features in section 7001(bb). A scan identifies potential weaknesses at scale. A penetration test validates how security controls behave when a qualified tester exercises defined access and transaction paths. The cybersecurity audit reviews the broader program and produces a report under sections 7122 and 7123. The same technical artifact may be useful to more than one activity, but the roles and conclusions differ.
For example, an e-commerce business might scan its external assets weekly, commission a manual test of the customer account and checkout flows after a major release, and have the independent auditor assess both activities along with access management, incident response and service-provider oversight. Those intervals and activities are an illustrative internal plan, not CPPA-prescribed dates. The owner must explain why the chosen evidence fits the business's systems and risk. A scan finding closed by patching is not the same as testing whether one customer can retrieve another customer's order history.
Section 7123(f) also allows a business to use an audit, assessment or evaluation prepared for another purpose if it satisfies the Article's requirements, on its own or through supplementation. That makes reuse possible, but it is not a blanket pass for a SOC 2, ISO 27001 or PCI package. The audit owner should map the existing work against CPPA's specific scope, independence, evidence and report fields before relying on it.
Build a technical scope the auditor can understand
Section 7001's definition of information system covers resources organized for processing personal information or providing access to it, regardless of ownership. That is broader than a list of servers owned by the business. Section 7123(c) also names authentication, encryption, account management, inventories, cloud configuration, secure development, service-provider oversight and incident response among the components to assess if applicable. A pentest will not verify all those governance practices, but its scope can test selected technical pathways through them.
Start the scope with the personal-information flow. Where does a California consumer enter information? Which account roles can see it? Which web and mobile clients call an API? Which integrations send it to a processor? Which identity provider or admin console can change who sees it? Then identify technical controls a penetration test can exercise without disrupting production services. For a portal, that could include authenticated role separation, account recovery, session handling and business logic. For cloud-hosted records, it could include publicly reachable storage, identity trust and application-to-storage permissions. For an internal estate, it could include access paths from a user workstation to stores of personal information.
The scope should also say what is outside the test and why. An exclusion may be sensible because the system is owned by another party, access is prohibited by contract, or a different method is more appropriate. Record the compensating evidence the audit owner has for that path. A tester should receive explicit authorization, bounded targets, permitted hours, test accounts, safe data-handling rules and an escalation contact. This is especially important where the business's information system spans managed cloud services and service providers. The CPPA rule does not itself grant permission to test a third party's infrastructure.
A buyer can use Stingrai's web application testing for authenticated consumer and employee roles, API testing for cross-account access and integration boundaries, and cloud testing when the scoped exposure reaches the control plane. Where the estate contains internal networks, the network testing service is a separate scope decision. Those services produce technical findings; the independent auditor determines how those findings bear on the audit.
The evidence package to request from a tester
Section 7122(d) prevents audit findings from resting primarily on management assertions. The auditor needs specific evidence, which the regulation says may include documents, sampling, testing and interviews. Section 7123(e) requires the audit report to identify the evidence examined, applicable components, gaps and the plan to address them. A penetration-test engagement is more useful when its outputs can be traced into those fields.
Evidence item to request | What it lets the business and auditor verify | Owner |
|---|---|---|
Approved scope and rules of engagement | Which systems, roles, endpoints and third-party boundaries were authorized; which were excluded | Security owner and tester |
Test method and dates | Which access levels, methods and time window produced the observations | Tester |
Asset and data-flow mapping | Why these targets are relevant to systems processing or providing access to personal information | Business, with tester validation |
Finding register | A reproducible description of each validated weakness, its impact and affected component, with sensitive proof controlled | Tester |
Remediation decision | Assigned owner, action, accepted risk if any, and status | Business |
Retest result | Whether a fix was independently checked and whether related paths remain vulnerable | Tester |
Auditor mapping | Which CPPA component and audit question each artifact can help the auditor assess | Audit owner and auditor |
The table is a proposed procurement artifact, not a list of report fields CPPA specifically commands pentesters to produce. Ask the auditor what level of detail it needs and how it wants sensitive evidence transferred. A safe report can show enough technical proof to make a finding credible while redacting consumer information and limiting the distribution of exploit detail. Procurement should specify retention and access controls for reports, especially where a vulnerability narrative could itself be sensitive.
Figure 2: A suggested evidence chain for an applicable penetration-test component. The rule requires evidence-based audit findings, applicable-component analysis and gap-remediation reporting; this workflow is a buyer implementation model. Source: CPPA, approved regulations, §§7122(d), 7123(e).
The business and auditor must retain all documents relevant to each cybersecurity audit for at least five years after completion under section 7122(g). That rule concerns audit documents. Before signing a testing statement of work, decide which party keeps the raw test notes, final PDF, redacted audit copy and retest record, and whether contract terms permit the auditor to inspect the necessary evidence. Do not assume that retaining only the executive summary will preserve the technical basis for an applicable test component.
A release-to-audit plan for the first coverage year
A business in the first section 7121 phase can use the months before January 2027 to close a few practical gaps. The following is an editorial work plan, not a regulatory timetable for penetration testing.
Planning point | Decision and output |
|---|---|
Before the audit year | Confirm section 7120 coverage, assign the independent auditor, map personal-information systems, identify current technical evidence, and agree on the criteria the auditor will use. |
At audit-year start | Record the system baseline and test plan. Put major product releases and processor changes on the calendar so the security owner can decide whether existing test evidence will remain representative. |
During the year | Run the selected tests, receive findings promptly, track fixes, and keep scope changes and exclusions. Give the auditor access to evidence in the form it needs. |
Before the report is completed | Retest material fixes, reconcile unresolved weaknesses and documented plans, and verify that report evidence matches the systems and period actually examined. |
By the applicable April 1 | Complete the independent audit report and the separate certification of completion required by sections 7121 and 7124. |
An audit owner should ask the auditor about independence early. Section 7122(a) permits an internal or external auditor, but requires objective and impartial judgment and restrictions on activities that compromise independence. The tester's technical independence is a useful quality criterion, yet it is not a substitute for the auditor's independence analysis. Keep the auditor and penetration tester roles clear in contracts and handoffs.
Questions for the penetration-testing RFP
These prompts make a bid comparable to the evidence need, without implying a CPPA-mandated testing frequency:
Targets: Which applications, APIs, cloud accounts, identity systems and internal access paths will you exercise, and how do they relate to our personal-information flow?
Authorization: What approvals and third-party platform permissions are needed? What are your production-safety limits and escalation path?
Roles: How many authenticated user roles and test accounts are included? Will you check cross-account and privileged access paths rather than only unauthenticated endpoints?
Method: Which manual and automated methods will be used? How will the report distinguish confirmed findings from scanner signals?
Evidence: Will we receive the exact scope, dates, methods, findings, controlled proof, and an executive summary suitable for an auditor's review?
Delivery: When are findings shared? Who answers questions during remediation, and is a retest included?
Audit handoff: Can the deliverables be redacted for the auditor while preserving enough evidence to support its independent conclusion?
Commercial terms: Is the quote limited to a single application or does it cover multiple systems, integrations, identity, cloud and retest work? What changes the fee?
No CPPA provision sets a test price. A quote should follow the estate and method the buyer needs. Stingrai's fixed web package prices apply to one web application and associated APIs; a multi-application or cloud/network scope is quoted for the engagement. For this regulation-focused guide, the useful comparison is scope, report depth, access rules and retest terms rather than an invented market price.
Where Stingrai fits
Stingrai is a Toronto-headquartered, CREST-accredited penetration testing services company that serves US and Canadian buyers. For a covered business's selected technical scope, its human-led engagements use two named penetration testers from a team with OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications. The team can test authenticated web and API roles, business logic and access controls, as well as separately scoped cloud and internal network paths. Every confirmed finding is posted to the PTaaS platform with prioritized remediation guidance; retesting is included. Human-led and hybrid reports include an attestation letter. Stingrai offers both one-time annual tests and continuous programs.
The useful output for a CPPA audit program is the scoped technical report, finding record and retest evidence. The business supplies that material to its qualified independent auditor, who decides how it supports the audit's assessment of applicable components. For web applications and associated APIs, Stingrai can also pair testers with Snipe, its autonomous web and API agent, in a hybrid engagement where both test together throughout. This option applies only to web applications and their APIs.
Frequently Asked Questions
Does the CCPA cybersecurity-audit rule require penetration testing?
No blanket penetration-test mandate appears in section 7123(c)(6). The cybersecurity audit must assess listed program components if applicable, and the list includes vulnerability scans, penetration testing, and vulnerability disclosure. A covered business should decide which controls and tests apply to its information system with its independent auditor, then preserve specific evidence for the audit. Source: CPPA §7123.
Which businesses must complete a CCPA cybersecurity audit?
A business must complete the audit if it meets either route in section 7120(b): the referenced sale-or-sharing revenue threshold, or the adjusted annual-gross-revenue threshold plus processing personal information of at least 250,000 consumers or households or sensitive personal information of at least 50,000 consumers in the preceding calendar year. These are audit-specific criteria, so the business should document its own coverage analysis. Source: CPPA §7120.
When is the first CCPA cybersecurity-audit report due?
The first report is due April 1, 2028 for businesses above US$100 million in 2026 annual gross revenue; April 1, 2029 for the US$50 million to US$100 million 2027 band; and April 1, 2030 for the below-US$50 million 2028 band, assuming the business is otherwise covered. Each phase has a different first audit period. Source: CPPA §7121.
Must the cybersecurity auditor be outside the business?
No. Section 7122 allows an internal or external qualified auditor, but requires objective, independent judgment and safeguards against conflicts. An internal auditor has additional reporting and compensation safeguards in the regulation. A penetration tester can supply technical evidence without being the cybersecurity auditor. Source: CPPA §7122.
Can an existing SOC 2 or ISO 27001 assessment be reused?
Possibly. Section 7123(f) permits an audit, assessment or evaluation prepared for another purpose if it satisfies every requirement of the CPPA cybersecurity-audit Article, either alone or with supplementation. The audit owner should map its scope, independence, evidence and report to the CPPA provisions before relying on it. Source: CPPA §7123(f).
What should a penetration-test report contain for the audit file?
Ask for authorized scope and exclusions, method and dates, validated findings, controlled technical proof, remediation decisions and retest results. Then map the artifacts to the applicable component and the independent auditor's evidence request. This is a practical evidence package for the rule's specific-evidence and report requirements, not a mandated pentester report template. Source: CPPA §§7122(d), 7123(e).
How long must audit documents be kept?
The business and auditor must retain documents relevant to each cybersecurity audit for at least five years after completion. A security owner should arrange storage of the test report and related records that the auditor used, with access controls suitable for sensitive findings. Source: CPPA §7122(g).
Does a penetration-test report count as the CPPA certification?
No. Section 7124 requires the business to submit a written certification of completion to CPPA after a required audit year. The test report is potential technical evidence for the auditor; the certification is a separate business submission. Source: CPPA §7124.
Related reading
References
California Privacy Protection Agency, completed rulemaking and effective date.
California Privacy Protection Agency, monetary thresholds in the CCPA.
California Privacy Protection Agency, finalization announcement.
Talk to Stingrai
For a scoped technical test that produces findings and retest evidence for your audit program, Get a Quote or book a free discovery call.
