Question 1

We make over $100 million a year. Do we need a CCPA cybersecurity audit?

Accepted Answer

Revenue alone does not decide it. Above the $26,625,000 threshold, you are in scope if you also processed the personal information of 250,000 or more California residents or households, or the sensitive personal information of 50,000 or more, in the preceding calendar year. Separately, and with no revenue or volume test at all, you are in scope if you derived 50% or more of your annual revenue from selling or sharing personal information. The $100 million threshold is timing: if your 2026 gross revenue exceeds it, you are in the first tier, with an audit period opening January 1, 2027, and a certification due April 1, 2028.

Question 2

We don’t sell data, but we use ad tech. Are we ‘sharing’ under Article 9?

Accepted Answer

Possibly. The CCPA defines sharing as disclosing personal information to another company for cross-context behavioral advertising, whether or not money changes hands. Pixels and ad-platform integrations that pass identifiers about California residents can qualify. Sharing matters for the 50%-of-revenue condition and for the CCPA’s general applicability; it does not change the 250,000 or 50,000 head counts, which turn on processing.

Question 3

Is CCPA Article 9 only for California companies, or any company?

Accepted Answer

Any company. The test is whether you do business in California and process California residents’ personal information above the section 7120 thresholds, wherever you are incorporated or headquartered. A company based in New York, Texas, India, or the UK is measured the same way as one in San Francisco.

Question 4

When did CCPA Article 9 become effective?

Accepted Answer

January 1, 2026. The California Privacy Protection Agency’s board adopted the rules on July 24, 2025, and the Office of Administrative Law approved them on September 22, 2025. The first audit period opens January 1, 2027, and the first certifications are due April 1, 2028.

Question 5

How is Article 9 different from the rest of the CCPA?

Accepted Answer

Most of the CCPA sets out consumer rights (to know, delete, correct, opt out) and the notices and contracts businesses owe. Article 9 imposes an obligation on the business’s security program itself: an annual audit by an independent professional against 18 named components, with an executive certification to the regulator. It is the only part of the CCPA regulations that requires an independent audit.

Question 6

Does a SOC 2 Type 2 report satisfy the CCPA cybersecurity audit?

Accepted Answer

Not on its own. Section 7123(f) lets you build on an audit prepared for another purpose, but only where it meets every Article 9 requirement, with supplementation where it falls short. SOC 2 provides a foundation. Common shortfalls include scope (HR, applicant, and CRM systems outside the SOC 2 boundary), CCPA-specific personal information inventories, a formal vulnerability disclosure process, MFA coverage extending to contractors and service providers, and, for Security-only reports, business continuity and data retention.

Question 7

Can the consultant who helps us prepare also perform the audit?

Accepted Answer

No. Section 7122 bars the auditor from developing procedures, preparing documents, making recommendations about the program beyond articulating audit findings, or implementing or maintaining it. Plan for two separate parties, and start the search early.

Question 8

Do we submit the audit report, or just the certification?

Accepted Answer

Submit only the certification through the agency’s website by April 1. The report stays with your business. Both you and the auditor must keep it, with supporting documentation, for five years. It remains subject to subpoena.

Question 9

Who should sign the Article 9 certification?

Accepted Answer

A member of executive management who is directly responsible for cybersecurity-audit compliance, has sufficient knowledge of the audit to provide accurate information, and has authority to submit it. They sign under penalty of perjury.

Question 10

Is Article 9 the same as a CCPA risk assessment?

Accepted Answer

No. Risk assessments sit in Article 10, use a different definition of ‘significant risk,’ and run on a separate timeline. Being out of scope for one says nothing about the other.

Question 11

Are our vendors subject to Article 9 themselves?

Accepted Answer

The audit obligation sits with the business. Service providers and contractors have their own duty under section 7050(h): for personal information they collect under their contract with you, they must cooperate with your audit, make relevant information available to your auditor, and not misrepresent facts the auditor considers relevant. Section 7051(a)(5) lets your contracts make that explicit. Check whether agreements signed before the regulations were final say so.

Author: Sucheth

What is Article 9 of the CCPA, and why does it matter?

GDPR Compliance in 2026: Requirements, Costs and Fines

SOC 2 Compliance Cost in 2026: What You Actually Pay

12 Best Vendor Risk Management Tools in 2026 (Compared)

SOC 2 Compliance: The Complete Guide (2026)

Sprinto vs OneTrust vs MetricStream: Which GRC platform should you choose?