11 CCR 7120 TO 7124 · 7150 TO 7157
CCPA cybersecurity audit software for the CCPA audit requirements and CCPA risk assessment deadlines that start in 2028
California now requires an independent cybersecurity audit every year from businesses whose processing presents significant risk to consumers. The auditor cannot build your program for you, so the evidence has to exist before they arrive. Complies turns the 18 audited components into a calendar of owned, evidenced work.
From $47/mo · Prices published · No sales call · Monthly billing
Audit readiness
0 %
Built for teams of 5 to 200
What CCPA cybersecurity audit software does before the auditor shows up
CCPA cybersecurity audit software keeps the cybersecurity program that the California Privacy Protection Agency now requires to be audited every year running between audits, and holds the dated evidence the auditor will test. The rules took effect on January 1, 2026. Section 7123(c) lists 18 components an audit must assess where they apply, from authentication and encryption through vulnerability scans, audit logs, service provider oversight, incident response and backup recovery. Section 7122(d) says findings cannot rely mainly on management assertions, so a policy that says you review access quarterly counts for little without the dated review behind it.
Complies ships a CCPA cybersecurity audit library on every paid plan. Load it and you get 25 recurring obligations: each of the 18 components with a cadence, the auditor engagement, gap remediation, five-year record retention, the risk assessment review, and the two April 1 filings to the Agency. Starter is $47 a month billed yearly. Growth, at $119, adds the risk register, vendor due diligence, evidence history and readiness scoring. Scale, at $299, runs the CCPA audit as its own framework next to SOC 2 or ISO 27001. Complies is not an auditor and does not perform the audit; it is the system your team uses to be ready for one.
Complies assists with compliance workflows. It is not legal advice, and it does not certify you or guarantee audit outcomes. Your auditor decides; Complies gets you ready.
The three things a CCPA cybersecurity audit tests, and what software has to hold for each
A program that covers all 18 components
Section 7123(c) names 18 components, and the audit assesses each one that applies. Gaps usually sit in the ones no single team owns: the inventory of personal information, retention and disposal, service provider oversight, and segmentation. Complies gives every component an owner and a cadence, so none is left for the week before fieldwork.
compliance obligation trackingEvidence the auditor can sample
Findings must rest on documents reviewed, sampling and testing performed, and interviews conducted. That means the quarterly access review, the monthly network monitoring review and the annual restore test each need a file, a name and a date. Every completed obligation in Complies carries that record, and Growth keeps the history across cycles.
evidence collection softwareFixed dates that cannot slip
The certification of completion goes to the Agency by April 1 following each audited year, and risk assessment information is due on April 1 too, starting April 1, 2028 for assessments done in 2026 and 2027. Both sit on the calendar as fixed-date obligations, and gaps from the audit report become owned remediation items with dates.
audit readiness softwareCCPA cybersecurity audit deadlines by revenue, read off 11 CCR 7121
The first audit is phased in by annual gross revenue. Each audit covers a calendar year and the report is due by April 1 of the following year. These dates come from the regulation text the Office of Administrative Law approved in 2025.
| Annual gross revenue | Revenue measured for | Period the first audit covers | First audit report due |
|---|---|---|---|
| More than $100 million | Calendar year 2026 | January 1, 2027 to January 1, 2028 | April 1, 2028 |
| $50 million to $100 million | Calendar year 2027 | January 1, 2028 to January 1, 2029 | April 1, 2029 |
| Less than $50 million | Calendar year 2028 | January 1, 2029 to January 1, 2030 | April 1, 2030 |
| Any business that newly meets section 7120 after 2030 | The preceding year | The 12 months from January 1 | April 1 of the following year |
Who is in scope: a business that made 50 percent or more of its annual revenue from selling or sharing personal information in the preceding year, or a business above the CCPA revenue threshold ($26,625,000 since January 1, 2025) that in the preceding year processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers. The certification of completion is signed by a member of executive management who is directly responsible for the audit and submitted through the Agency website. Business and auditor both keep the audit documents for at least five years. If you are also comparing broader compliance platforms that list CCPA among their frameworks, see the detail on OneTrust alternatives, Secureframe alternatives and Vanta alternatives.
CCPA cybersecurity audit software vendors, what each covers and what each publishes on price
We opened each vendor's own product and pricing pages on October 8, 2026. The category mixes three different kinds of tool, so read the coverage column before the price column.
| Option | What it covers | Who it fits | Published pricing (October 2026) |
|---|---|---|---|
| Complies | CCPA cybersecurity audit library with 25 recurring obligations and six policies, risk register, vendor due diligence, dated evidence; the CCPA audit as its own framework on Scale | Companies of 5 to 200 people with no GRC team that fall in scope and need the program running before an auditor tests it | Yes. Starter $47, Growth $119, Scale $299 a month billed yearly; $95, $239 and $599 monthly |
| RiskQ ValuRisQ CCPA | Automated CCPA assessment scope, control tests built on a framework you choose such as NIST CSF or ISO 27001, policy templates and reports | Small and mid-size businesses that want an assessment product sized by systems and vendors | Yes, on AWS Marketplace: $15,000 a year for up to 20 systems and vendors, $25,000 for 50, $40,000 for 100, $75,000 for 200 |
| Secureframe | Compliance automation with integrations, policies, training and vendor management, with CCPA listed among its frameworks | Cloud software companies that need SOC 2 or ISO 27001 first and CCPA alongside | Partly. Fundamentals starts at $7,500 a year for one framework; other tiers are quoted |
| Vanta | Compliance automation with a CCPA product page, automated tests through integrations and a trust center | Venture-backed SaaS companies running several frameworks with an engineering team to wire integrations | No. Quote only; Vendr reported a median near $20,000 a year across 372 contracts in February 2026 |
| OneTrust | Privacy program suite: consent, data mapping, data subject requests and assessments, with security modules sold separately | Larger companies that need the privacy operations side of the CCPA, not only the audit | No. Vendr reported a median of $12,000 a year across 309 purchases in September 2026 |
| Lepide and Netwrix | Data access auditing: who opened, changed or moved files and directory objects holding personal information, with compliance reports | IT teams that need activity logs and access reports for file servers, Active Directory and Microsoft 365 | No. Both ask for a custom quote |
The honest dividing line is what the tool does. Lepide and Netwrix produce the logs and access reports that some components need as evidence. OneTrust runs the privacy side of the CCPA, which the cybersecurity audit does not cover. RiskQ is built around a scored assessment. Complies, Secureframe and Vanta hold the program and its evidence, and Complies is the one with a published price a small company can approve without a sales call.
What changes when the CCPA audit program lives in software instead of a binder
No component is discovered missing during fieldwork
All 18 components arrive with an owner and a cadence on day one, including the four nobody owns by default: the personal information inventory, retention and disposal, service provider oversight and segmentation. The calendar shows which are current and which have never been done.
The auditor tests records, not promises
Section 7122(d) bars findings that rest mainly on management assertions. A dated access review, scan report, restore test and training record answers the sample request in minutes, and the auditor spends billable hours on testing rather than chasing files.
The April 1 filings are on the calendar every year
The certification of completion and the risk assessment submission both sit as fixed April 1 obligations with an executive owner. Nobody has to remember that the first risk assessment filing, due April 1, 2028, covers assessments done in 2026 and 2027.
One program answers the CCPA, SOC 2 and ISO 27001
Access reviews, encryption, logging, vendor oversight, incident response and backup testing appear in all three. Each library obligation counts toward a shared control area on the control map on Growth, and section 7123(f) lets a business use an audit done for another purpose if it meets the CCPA requirements.
Five years of records without a second system
Section 7122(g) requires the business and the auditor to keep audit documents for at least five years. The obligation history and evidence files stay in the workspace, and the retention obligation reminds the owner to confirm where each year's audit file sits.
A price you can approve before the first audit year
Starter is $47 a month billed yearly with the CCPA library included. Growth at $119 adds the risk register, vendor due diligence and evidence history. Scale at $299 adds custom frameworks, roles and an audit export pack. Monthly billing is $95, $239 and $599.
Setting up the CCPA cybersecurity audit in Complies
Load the CCPA cybersecurity audit library
From the calendar, load the library onto a running framework or, on Scale, as its own framework. 25 obligations arrive with their cadence: monthly network monitoring, quarterly MFA, access, vulnerability and antimalware checks, six-month configuration, logging and port reviews, annual work for the rest, and the two April 1 filings.
Give every component an owner
Assign each obligation to the person who does the work: IT for authentication and patching, engineering for secure development, operations for service providers, legal or privacy for retention and risk assessments, and an executive for the certification. Reminders go to the owner before the due date.
Draft and approve the six policies
Information security, access control, personal information retention and disposal, service provider oversight, the incident response plan, and business continuity and disaster recovery. Start from a drafted version, edit it to match how your company works, and approve it.
Engage the auditor and run the year
Record the auditor engagement and the reporting line that keeps an internal auditor independent, then work through the obligations as they come due. The readiness report and obligation history are what you hand the auditor, and the gaps in their report become owned remediation items.
Who this is for, and who it is not
A GOOD FIT WHEN
- Your business meets section 7120: half or more of revenue from selling or sharing personal information, or revenue above $26,625,000 with 250,000 consumers or 50,000 sensitive records processed.
- You have 5 to 200 people, no dedicated GRC team, and need the 18 components running with dated evidence before your first audit year begins.
- You already hold SOC 2 or ISO 27001 and want the same evidence to count toward the CCPA audit instead of building a second program.
- An executive will sign the certification of completion and wants a record that backs the signature.
LOOK ELSEWHERE WHEN
- You need the audit itself. Section 7122 requires a qualified, independent auditor, and the auditor must not prepare your documents or run your program. Complies is the tool you use, not the auditor.
- You need consent banners, data subject request handling or automated data mapping for the privacy side of the CCPA. Complies does not ship those; a privacy suite such as OneTrust does.
- You need the technical controls themselves: MFA, encryption, vulnerability scanning, log collection or backups. Those come from your IT stack; Complies tracks that they are in place, reviewed and evidenced.
- You need ADMT pre-use notices and opt-out handling. The ADMT rules are a separate part of the same rulemaking and are not in this library.
CCPA cybersecurity audit questions buyers ask
It is a rule from the California Privacy Protection Agency, in effect since January 1, 2026, that requires businesses whose processing presents significant risk to consumers' security to complete an independent cybersecurity audit every year. The audit assesses up to 18 program components, and an executive certifies completion to the Agency by April 1 of the following year.
A business needs one if, in the preceding year, it made 50 percent or more of its revenue from selling or sharing personal information, or it exceeded the CCPA revenue threshold, $26,625,000 since 2025, and processed the personal information of 250,000 or more consumers or households or the sensitive personal information of 50,000 or more consumers.
It depends on revenue. Businesses above $100 million in 2026 revenue complete their first audit report by April 1, 2028, covering 2027. Businesses between $50 million and $100 million in 2027 revenue are due April 1, 2029. Businesses under $50 million in 2028 revenue are due April 1, 2030.
The auditor must be qualified, objective and independent, and use procedures accepted in the auditing profession, such as AICPA, PCAOB, ISACA or ISO standards. An internal auditor is allowed, but must report to an executive with no direct responsibility for the cybersecurity program, and cannot build or run the program they audit.
Section 7123(c) lists authentication, encryption, account management, inventory of personal information, secure configuration, vulnerability scans and penetration testing, audit logs, network monitoring, antimalware, segmentation, ports and protocols, awareness, training, secure development, service provider oversight, retention and disposal, incident response, and business continuity and disaster recovery.
Partly. Section 7123(f) lets a business use an audit, assessment or evaluation done for another purpose if it meets all the CCPA requirements, alone or supplemented. SOC 2 and ISO 27001 cover most components, but you still need to check the scope against all 18 and confirm the report contains everything section 7123(e) requires.
A CCPA risk assessment is a documented review required before processing that presents significant privacy risk, such as selling or sharing personal information or processing sensitive personal information. Existing processing must be assessed by December 31, 2027, reviewed at least every three years, and summarized to the Agency by April 1, 2028.
Complies publishes $47, $119 and $299 a month billed yearly, with the CCPA cybersecurity audit library on every paid plan. RiskQ publishes $15,000 to $75,000 a year on AWS Marketplace by number of systems and vendors. Secureframe publishes a $7,500 a year starting price for one framework. Vanta and OneTrust quote on request.
Failing to complete the audit or submit the certification is a CCPA violation. Administrative fines, adjusted for inflation in 2025, are up to $2,663 per violation and up to $7,988 per intentional violation or violation involving minors under 16. A business that suffers a breach may also face consumer lawsuits for $107 to $799 per consumer per incident.
No. Complies is compliance software, not an auditor. It holds the 18 components as owned recurring work, stores the evidence, tracks the April 1 filings and turns audit gaps into remediation items. The audit itself must be done by a qualified, independent professional you engage, internal or external.
Frameworks and guides
SOC 2 compliance software
ISO 27001ISO 27001 compliance software
CCPACCPA Compliance Cost Including the Cybersecurity Audit
GDPRBest GDPR Compliance Software Compared (8 Tools)
PRICINGHow Much Does Compliance Software Cost in 2026?
VENDORSVendor Risk Assessment Template and Risk Rating Method
Put the CCPA cybersecurity audit program on a calendar before your first audit year starts
Prices published, $47 to $299 a month. Monthly billing. Start today, no sales call.