Direct Answer: California now requires covered businesses to run annual cybersecurity audits and certify results to the state. Rules took effect January 1, 2026, with first audit deadlines phased from 2028 to 2030 by revenue.
You probably heard something about a new California cybersecurity audit rule and then went back to running your business. That is normal. But this one is different from the usual privacy noise, because it comes with certification to the state and document retention deadlines.
The amendment to California’s privacy law took effect January 1, 2026. Covered businesses now have to run annual cybersecurity audits and certify the findings to the California Privacy Protection Agency.
The two questions Monterey County owners keep asking us are simple. Does this apply to me, and what do I need to do first? This article answers both, walks through the phased deadlines, and explains what a real risk assessment looks like when you have never had one done.
Who Falls Under the California CPRA Cybersecurity Audit Rule
Most local owners assume this is a Silicon Valley problem. Plenty of mid-sized Salinas and Monterey businesses are going to be surprised.
The rules apply to for-profit businesses that meet at least one of these three tests:
- Annual gross revenue above roughly $26.6 million (the figure is adjusted for inflation)
- Buying, selling, or sharing the personal information of 100,000 or more California consumers in a year
- Deriving 50 percent or more of annual revenue from selling or sharing consumer personal information
That first threshold is the one that catches people. A single produce shipper in the Salinas Valley, a multi-location dental group on the Peninsula, or a Watsonville cooling and packing operation can clear $26.6 million in gross revenue without ever thinking of itself as a data company.
The second test catches organizations with big contact databases. Hospitality groups in Carmel and Monterey that run loyalty programs and online booking, or a regional nonprofit with a large donor and client list, can move past 100,000 consumer records faster than they expect.
Revenue is gross, not profit. And it is measured on the business as a whole, not per location. If you are close to any of these lines, the honest first step is confirming where you actually stand. Our team walks through the same qualification questions in this breakdown of who the audit rule covers.
The Documentation Requirement Has Real Teeth
The audit itself is only half of it. The paperwork is where unprepared businesses get hurt.
Under the finalized regulations from the California Privacy Protection Agency, covered businesses face three obligations that matter more than most owners realize:
- The agency can request risk assessment materials at any time, and you get roughly 30 days to produce them
- Documentation must be retained for five years
- Failing to conduct or properly document a required audit can be treated as a separate violation on its own
That last point is the one worth reading twice. You do not need a breach for a problem to exist. The absence of records is the problem.
Thirty days sounds generous until you try it. If nobody has ever inventoried your systems, mapped where customer data lives, or written down who has administrator access, thirty days is not enough time to reconstruct years of history.
California already runs a tight clock on breach notification, and this new requirement sits right next to it. We covered how those timelines interact in our look at California’s 30-day breach clock.
The businesses that will handle a records request calmly are the ones already keeping a current assessment on file. Everyone else will be scrambling during harvest season or the middle of Concours week.
Phased First Audit Deadlines by Revenue Tier
Deadlines are staggered based on gross revenue for 2026. These are the first reporting dates, not the date to start preparing.
| 2026 Gross Revenue | First Audit Due | Practical Start Window |
|---|---|---|
| Over $100 million | April 1, 2028 | Assessment and gap work should already be underway in 2026 |
| $50 million to $100 million | April 1, 2029 | Begin assessment in 2026 or 2027 to allow time for remediation |
| Under $50 million | April 1, 2030 | Baseline assessment now, remediation spread across budget years |
| Below all coverage thresholds | Not required | Same controls still reduce breach and insurance risk |
Why April 2030 Is Not as Far Away as It Sounds
A local business under $50 million in revenue looks at April 1, 2030 and reasonably decides to think about it later. That math breaks down fast.
An audit certifies the state of your controls. If the controls are not there yet, an audit just documents the gaps in writing. Closing those gaps is the actual work, and it takes months.
Here is what typically has to happen before an audit produces a clean result:
- Inventory every system, server, and cloud service that touches personal information
- Get multifactor authentication deployed across email, remote access, and admin accounts
- Fix backup gaps and actually test a restore, not just confirm the job ran
- Tighten firewall rules and remove access that departed employees still have
- Write down policies for passwords, device use, and vendor access
- Train staff and keep records showing the training happened
That list is a budget cycle or two for most 20 to 100 person organizations, not a weekend. Ag operations in particular have a narrow window, because nobody is upgrading a network in the middle of a Salinas Valley harvest push.
There is also the enforcement gap to consider. Nothing in the phased schedule protects you from a breach, a lawsuit, or an insurance carrier questionnaire in 2027. The same gaps that fail an audit are the ones that let ransomware in, which is why we keep returning to the five gaps that show up in almost every small business network.
What a Cybersecurity Risk Assessment Covers
A risk assessment is the foundation the eventual audit sits on. This is the sequence a well-run assessment follows.
What a Risk Assessment Actually Involves, in Plain Terms
A risk assessment is not a scan someone emails you. It is a structured review of what you have, where your data sits, and what is protecting it.
The discovery phase is unglamorous and necessary. Someone walks your network, lists every server, workstation, access point, and cloud service, and asks who has keys to each one. This is where forgotten items surface: the old file server nobody decommissioned, the shared login three people still use, the wireless network a former technician configured years ago.
We heard from an inn on the Peninsula whose longtime technician had passed away, leaving staff holding a wireless controller login with no idea what to do with it. That is a documentation gap and a security gap at the same time.
When the work is done properly, you should walk away with:
- A written asset and data inventory you can hand to an auditor or insurance carrier
- A ranked gap list that separates urgent items from nice-to-have items
- A remediation roadmap with rough timelines and budget ranges
- A record of the assessment date, scope, and method, filed for retention
Cost depends on how many locations, users, servers, and cloud platforms are in scope, and whether compliance frameworks like HIPAA or PCI apply. A three-person office in Soledad and a 70-staff school district across three sites are not the same project. Rather than quote a number here, ask for scope-based pricing so you know what drives it.
If you want a sense of the target state before you start, our write-up on what a real security baseline looks like is a useful yardstick.
Frequently Asked Questions About the California Cybersecurity Audit Rule
My business is under the revenue threshold. Can I ignore all of this?
You can skip the certification requirement, but not the underlying risk. California’s breach notification obligations apply regardless of size, and carriers and larger clients increasingly ask for proof of controls before they sign. Many businesses under the threshold do a baseline assessment anyway, because it is the same work either way.
Can my current IT provider do the audit, or does it need to be someone independent?
Those are two different things. A risk assessment and gap remediation are day-to-day IT and security work. The formal certified audit carries independence expectations, so plan on a separation between the team fixing the gaps and the party attesting to them.
What happens if the state asks for our documentation and we do not have it?
You get roughly 30 days to produce what was requested. Not having the records can be treated as a violation on its own, apart from any breach. That is why the retention piece matters as much as the assessment itself.
How long does a first assessment take for a business with about 40 employees?
Discovery and review usually run a few weeks depending on how many locations and cloud systems are involved. Remediation is the longer stretch, often several months, because things like backup redesign and access cleanup have to happen without knocking operations offline.
We are an agriculture operation with seasonal staff and shared logins. Does that create a problem?
It is one of the most common findings we see in the Salinas Valley. Shared accounts make it impossible to show who accessed what, which is exactly what an audit looks for. Individual accounts plus a clean offboarding process fix most of it, and both are easier to set up during a slower month than during peak season.
Want to Know Where Your Business Stands?
Most Monterey County organizations we talk to are not sure whether they are in scope, and that uncertainty is the hardest part to plan around. Adaptive Information Systems works with businesses across Salinas, Monterey, Watsonville, and Hollister on risk assessments, documentation, and the security work that has to happen before any audit is on the calendar. If you want to talk through your situation, we are at (831) 644-0300 or adaptiveis.net.
