California’s Cybersecurity Audit Rule

Why It Matters

The rule forces thousands of midsize and large firms to formalize annual cybersecurity audits, reshaping risk‑management practices and expanding the market for audit providers while tightening enforcement of California’s privacy standards.

Key Takeaways

• California Privacy Protection Agency adopted cybersecurity audit rule.
• Audits required for businesses posing significant risk to personal data.
• Coverage thresholds: $26M revenue, 250k consumers or 50k sensitive records.
• Companies may use internal or external auditors; board oversight reduced.
• Staggered compliance dates start 2028, giving large firms lead time.

Summary

The Berkeley Center for Law & Technology hosted Jim Dempsey to explain California’s newly adopted cybersecurity audit rule, part of a broader package that also addresses automated decision‑making technology and risk assessments. Adopted on July 24 by the California Privacy Protection Agency, the rule fulfills obligations under the 2020 California Privacy Rights Act (CPRA) and mandates annual, independent audits for businesses whose processing of personal information presents a significant risk to consumers.

The regulation defines “significant risk” using size and data‑processing thresholds: firms with annual gross revenue over $26 million, processing data of at least 250,000 consumers (or 50,000 sensitive records), or data‑brokers earning 50 percent of revenue from selling personal information. Audits may be performed by internal or external auditors, though reporting responsibility was softened from the board to senior management. Large entities (> $100 million revenue) must file their first audit by April 2028, with staggered deadlines extending to 2031 for smaller covered firms.

Dempsey highlighted the rule’s practical nuances, noting the inflation‑adjusted revenue benchmark and the inclusion of employee data for B‑to‑B companies. He cited ongoing enforcement by the Department of Health and Human Services and California’s Attorney General, who have already begun demanding risk analyses and inventories. The rule also references the Center for Internet Security’s Critical Controls as a baseline for “reasonable” cybersecurity measures, echoing prior guidance from former AG Kamala Harris.

For companies operating in or serving California residents, the rule creates a substantial compliance imperative, driving demand for audit services and elevating cybersecurity to a board‑level concern. Early adoption and thorough documentation will be critical to avoid enforcement actions and to demonstrate reasonable security practices under California’s expanding privacy framework.

Original Description

With compliance deadlines starting in 2028 and strict requirements for risk assessments, data governance, and audit procedures, new cybersecurity rules are on the horizon. Join us in this timely and practical session as renowned privacy and cybersecurity expert Jim Dempsey breaks down California’s groundbreaking new CPRA cybersecurity audit rule, what it means for your organization, and how to prepare now to avoid legal and regulatory pitfalls later.

Need CLE Credit? Watch the program on B-CLE: https://bcle.law.berkeley.edu/program?id=85577

► Homepage: https://www.law.berkeley.edu/research/bclt/

► View our CLE Catalog on our B-CLE Platform: https://bcle.law.berkeley.edu/

#BCLT #UCBerkeleyLaw