CCR 7123 Scope the audit across the 18 programme components and report fully

The audit assesses how the cybersecurity programme protects personal information from unauthorised access, alteration, destruction, use or release, and from loss of availability, covering the written programme and each applicable component: authentication (including phishing-resistant MFA), encryption, access and privileged account management, data, hardware and software inventories, secure configuration and patching, vulnerability scanning and penetration testing, log management, network monitoring and data loss prevention, anti-malware, segmentation, port and protocol control, awareness, training, secure development, oversight of service providers and third parties, retention and disposal, incident response and business continuity. The report describes the system, criteria and evidence, the effectiveness of controls, gaps with a dated remediation plan, prior-report corrections, responsible individuals, the auditor's signed independence statement, and any breach notifications made. An audit done for another purpose, such as against NIST CSF 2.0, may be used if it meets the article, alone or supplemented.

Source: CCPA/CPRA, CCR 7123. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open CCPA/CPRA in the compliance library.

Applies only to a business that meets one of the thresholds in Cal. Civ. Code 1798.140(d).