California’s new cybersecurity audit requirements – Are you ready?

0:00Thought Leadership from PwC's National Office. Hello, and welcome to PwC's accounting podcast. I'm Heather Horne. Thanks for joining us today as we jump into current topics in accounting and reporting. For today's discussion, I'm pleased to welcome guest host Diana Stoltzfus, a partner in PwC's national office and a podcast regular. I'll hand it over to Diana for more details on today's episode.

0:35Today, we're discussing California's Privacy Protection Agency's new cybersecurity audit requirements under the CCPA regulations. This is part of a broader regulatory package of updates that introduce new rules around automated decision-making technology and risk assessments. In this episode, we'll focus on the cybersecurity audit requirement, who may be subject to it, why scoping and auditor independence require careful planning, and how companies may be able to build on the work that they've already completed. Joining me today are Mark Cornish, a partner in PwC's Digital Assurance and Transparency practice, and Chris Santucci, a partner in PwC's Cyber, Data, and Technology Risk practice.

1:15Thank you both so much for joining me today. So Mark, maybe we'll start with you and we'll start with the basics. So what is the new cyber audit requirement? Thank you, Diana. So this is a new recurring independent audit of a company's cybersecurity program that requires auditor and executive attestation. It's important to understand though that this is not a self-assessment, this is something new. It's not simply another privacy policy or consumer notice requirement, it introduces a recurring independent audit of the company's cybersecurity program. The audit report itself must identify relevant gaps or weaknesses and management should document remediation plans and expected resolution timeframes for any matters arising.

2:02A member of executive management must certify completion of the audit to the CPPA, also known as CalPrivacy, under penalty of perjury. Oh, wow. Meeting the requirement will require coordination across many functions. I think this is what also makes this really different, to be honest, at the end of the day, is that it needs coordination across privacy cyber security legal internal audit finance procurement technology and business leadership so it's really like across the entire organization so it's a it's a it's not an easy check the box exercise here it's not an easy undertaking um so the other aspect of this as well is that many companies are focused on the april 20 28 reporting deadline so that's when there's certification to the cppa is required up to CalPrivacy.

2:50But the more important preparation due date is January 1st, because January 1st, 27 is when the first audit period begins. Okay. So companies have to be ready and have these controls. We'll talk more about what it is, but in place throughout that entire period. So really looking more towards January 1, 2027. Correct. Okay. Maybe Chris, turning to you now, so what companies are subject to this audit requirement? Yeah, so Article 9 applies to businesses whose personal data processing presents significant risk to consumer security. And that's really defined in two different ways. One, a business derives at least 50 % of its annual revenue from selling or sharing consumers' personal information.

3:32And that's not limited to revenue in California. Okay, so you're looking at revenue generated. Okay. And two, a business meets the CCPA's CPI adjusted, so the consumer price index, the revenue threshold. And this was$25 million when it started. It's now above 26. So definitely important for companies to monitor this threshold, especially if they're right on the border. and either processes personal information about 250 ,000 consumers or households or processing sensitive personal information of at least 50 ,000 consumers. And so commonly overlooked areas are marketing data, human resource data, if you're acquiring a business, the data that they may have, especially around more and more digital experiences.

4:17So think about geolocation data. So non-traditional places where personal data might exist that would bring your numbers up and bring you into scope. And so really for companies near those thresholds, you can't just give a rough estimate to say you're out of scope. So you really need to do the work, work with finance, your privacy, your data teams to build that defensible view of scoping. Okay, okay, very helpful. So Mark, why is this such a bigger lift than other security compliance work? Yeah, no, that's a good question. Two things I would highlight. One, the independence bar has been set high.

4:52So for example, there needs to be real reporting line separation for intel auditors and we'll talk about this more as we go through this podcast here and the other aspect is the evidence bar so findings need documentation and support and testing goes beyond interviews so essentially it's going to require design and operating effectiveness testing you know so it's not just a management assertion process like there's full you know there's robust testing that needs to be done to support this audit requirement this discipline will feel more familiar to organizations accustomed that have you know are subject to socks as an example or um that go through sock reporting so for example sock reporting over security controls or that go through robust intel audit testing um compared to those that maybe just go through like privacy questionnaires and other right so that you know that the audit itself is really intended to be a robust audit that really challenges design and operating effectiveness ultimately over that period of time that we talked about earlier.

5:52The one thing I would also add is it is critical to understand that Article 9 has its own scope, independence requirements, reporting obligations, and certification requirements. So the organizations need to fully understand those and be prepared for the future audit. Okay. You've mentioned independence a couple of times. And when we think about independence, You know, my background is traditionally as an auditor. So you have like SEC independent audit requirements. And, you know, independence can kind of mean different things in different frameworks. So can you maybe speak a little bit about in this context what independence means?

6:28Yeah, sure. So within Article 9, the rule lays out the independence requirements within the rule. So as I mentioned, it can be an independent auditor or an external auditor. but the requirements, the rule itself actually goes through in details. These are the factors you need to consider. The bar itself, I would say, is actually defined, as I said earlier, as high. Because even if, you know, so if we're applying SEC audit requirements, this actually goes a bit further in certain aspects, believe it or not. So it talks about the ability to provide recommendations and could that potentially be a conflict for the auditor if they were to do the assessment.

7:09So I think there's aspects of that that I think from, if I'm kind of guiding organizations, I would say that, you know, working with the chief legal officer and other parties in the organization to interpret this. But I think the definition of the auditor for independence is actually a very important aspect of the rule. Yeah, and it's interesting because, you know, there's like this external auditors that may or may not be able to do certain things and internal auditors can be used. But again, you have to have these certain reporting. So it sounds like it is an area to focus on when you're thinking about who's going to do this and making sure that you meet those requirements.

7:44At the end of the day, the auditor, again, I just clarify this, has to be an internal or external priority. But a key part of this is they have to be qualified. They have to be objective and they have to be independent in line with those Article 9 requirements. So as I said before, the auditor cannot participate in activities that can comprise independence. So that includes you can't develop documents or procedures related to the cyber program, or you can't implement or maintain certain parts of the program, which may seem obvious to many of us. But the part of it that's kind of even more restrictive is it talks about the auditor can't be making recommendations beyond articulating audit findings.

8:24So even a potential recommendation may create a potential audit conflict. Sounds complicated. Okay. Well, that was very helpful. Maybe, Chris, turning to you and changing the subject a little bit, why should executive CFOs be focused on this new audit requirement? I think primarily because it's not just a cyber or privacy issue. We're really talking about enterprise governance, enterprise risk, and it needs the proper investment. So the finance leaders that are on the podcast today, they understand annual compliance cycles, control testing, evidence levels. These are things that are very common today.

9:02They understand the discipline, the rigor that's needed. And so the CFO should be asking, are we in scope? What can we leverage? Who's on first for a lot of these activities from an accountability perspective? Do we know that we have big gaps in the requirements? How are we approaching remediation, et cetera? And as well as who's actually going to do the certification and are they properly prepared for that? Right. And I guess one thing that we haven't talked in detail about is, what are the total kinds kinds of like different aspects of the company that this covers, right? We've talked about, you know, that we, you know, you need to involve lots of parties across the organization, and it's not just limited to cybersecurity.

9:41So maybe can you give us some idea around like, what are some of the complications or challenges that companies are facing that are thinking about meeting this requirement? Yeah, and this is this is where the work needs to be done, right? Because personal data that's in scope is really across the organization. When you think about how today's organizations operate, including extending to your third parties. So a traditional SOC 2 or audit that where the company might be looking to leverage is typically very focused, right, to a specific boundary of systems or processes. When we think about this, it's much broader.

10:16So the first effort here around readiness really requires the organization to take a step back, understand that personal data flow and the related systems that support it in third party, and that becomes your initial boundaries. And the Article 9 requirements also pull in service providers and contractors and vendors right directly. So they have an obligation to support your audit as well and provide information. So that's going to be a change for many of our clients and how they typically think about audits and how far they go. They're not just asking their employees who manage those relationships.

10:51They may actually need to invoke some audit clause to gather some information to support their control environment. So it's really any system, really, or even third party, as you're saying, that touches this privacy, this customer data that's moving throughout your organization. So as it moves through the organization and different systems and maybe third parties interact, it's really all of that comes into this. That's where the work needs to be done, because if you can tell where the data that's in scope sits within a system, then great. If you're unsure, then you might have a risk of overscoping or underscoping.

11:24So that's the hard work that needs to be done so that if you do a test and there is a failure, you can actually attribute it to the specific risk. I would just add, I think from my perspective when talking to clients, I think this is one area that should not be underestimated. I think this is challenging. And getting a full handle across the organization is not an easy task necessarily. so i think ensuring that you're spending appropriate time going through this exercise and understanding that flow is like really critical to the overall process i mean when it comes to the controls aspect of this when you look at the requirements of the rule i would say that generally directly standard cyber security hygiene areas but the scoping of the systems is the most critical part because then you then you're required to make sure that are those controls in place covering all these areas and and historically where we've done similar engagements or reviews in this area that's where we've seen issues arise where you know there isn't encryption in place on certain systems as an example or they're not able to dispose of certain like customer information easily for certain systems etc so i think that the scoping piece from the outset is really what drives the extent of how detailed this review is going to be and it is definitely the most challenging part i think i agree yeah and i think you know it seems like there could be systems maybe, and I think we'll get into this maybe in the next question is that maybe have been in scope for other reasons.

12:48And so you might have a better understanding and maybe this is bringing in new systems where you haven't done as maybe much historical testing or understanding. And so maybe playing on that is, you know, as we've talked about, companies may already have SOC 2 reports, NIST-based assessments, SOCs-related testing, maybe ISO. And so can Can companies leverage these different testings that maybe have been done for other reasons? Yes, 100 % they can. The rule actually explicitly talks about that, about leveraging of our audits and assessments. So Article 9 allows for companies to leverage an audit or assessment built for other purposes as long as it meets all the requirements of the rule.

13:31And so maybe that gets back to kind of this evidence-based testing too. Yeah. Yeah. So if you're having, like as an example of SOC 2 covered, that may cover, generally we're seeing probably 60 to 70 % of the controls that may be required overall for this cyber audit. But there's also a delta there in terms of systems, because as an example of SOC 2 normally may only cover 20, 25 systems. But if you've defined 100, 200 systems in scope for this rule, there's obviously a delta there as well so really what's expected is that um the client organization should go through an assessment to understand that mapping in terms of what can potentially be leveraged and really what the delta is and also the question becomes is like how do you get coverage and get comfortable throughout the calendar year period which is the requirement or the rule because not all those reports are going to align with that period as well so So, you know, a NIST, giving a very example, and this comes up a reasonable bit, a NIST CSF maturity assessment.

14:32Many of our clients get those done. We have had some conversations with clients where they're like, oh, we should be good. We have a NIST maturity assessment. And we're like, well, it's a bit more complicated than that. Right. You know, I think that's a great starting point to highlight your cyber audit needs. However, our clients really need to go deeper than that and perform evidence-based audit procedures at a level sufficient to support auditor findings. And that really, at the end of the day, what does that mean? That includes sample testing across the environment of controls to make sure they are designed and operating effectively over that period.

15:05And it's efficiency opportunity as well, right? we're encouraging clients not to start over given the regulation allows you to leverage this testing, but also don't assume that you have the right coverage if you have a number of these reports in place already today. So we're encouraging doing that mapping early to identify the testing that's already been done, mapping out the scope, the time periods, all these different items, and identify where there's gaps where you have to do testing. And even if you find that you can leverage those reports, the auditor might need to supplement. Finance leaders are very aware of using the work of others and the standards that you need to follow.

15:44So you might need to supplement some of the existing testing as well. Okay, making sure it meets the requirements of this regulation. I mean, at the end of the day, like every client and organization is different. So that's why this needs to go through a thoughtful process from the outset to really ensure your defining score, So identifying leverageability, you know, thinking about, you know, next steps and how do you address gaps, etc. So it's, again, we couldn't highlight more like this is not an easy undertaking being prepared for this. So I guess starting with that, I mean, I think you've given a lot of good advice.

16:18But if we think about, you know, companies maybe wanting to take action soon, now, within the next 90 days, maybe starting with you, Chris, what would you highlight as kind of a first step in starting this process? Yeah, maybe I'll start and then Mark, you can add on. I think first, if you're a CFO listening to this or a finance leader, if this is new to you, I would act quickly and ask the questions given that again, these regulations were finalized last September and came into effect recently here. So first, confirm applicability and document the basis for all your conclusions. Second, establish the right governance and accountability structure.

16:56So think privacy, cyber, legal, IT, internal audit, et cetera. All the impacted parties, get them on board with the scope and the effort and making sure that everybody's accountable. Third, really make sure, as we've been talking about today, define the scope, right? Where is the data that's applicable to CCPA Article 9? Where is that information being processed? And don't forget about your vendors and third parties. And then you're really setting that boundary for everything to come in your audit program. Mark? Yeah, I would say that the next stage after that is to perform some form of readiness assessment, including evidence reviews.

17:36Again, we keep talking about evidence. Evidence is important. If you can't prove it, you know, if there's no support. It's not supported, right? It's not supported, exactly. So organizations should be going through a mapping of current controls to the Article 9 requirements. I think that's the first stage after the scoping exercise. And then really going through a process to identify gaps. And obviously then, assuming there are gaps, which most likely will occur across most of these reviews, we suspect, then determine what are the remediation plans that need to be in place to address those gaps.

18:11ideally trying to remediate prior to the start of the audit period. The one other thing I would say, though, is the organization should also decide early who's actually going to perform the audit. So who's going to perform the audit for that calendar year 27? Independence questions can affect both readiness support and the eventual assurance model that you adopt. So that really shouldn't be deferred. I mean, I think there's various ways that an organization can approach this, whether it's using internal audit or external audit. But I really think that's something organizations really should be thinking about now and shouldn't leave that to a 27 question.

18:48Right. Especially given the volume of organizations that are going to fall into the first wave trying to get ahead, especially if you want to go external or need internal support. There's going to be a race to find the right provider for you. And Mark, one more thing to add, also preparing the executive who will certify. And that might be a different role within different organizations. But that person definitely needs a governance process that provides timely visibility into the scope, findings, remediation efforts, and auditor independence, not just a package deliverable at the last second. Okay, maybe Chris, anything from the privacy program side that you'd want to add?

19:28I think it's a primary, it's a collaboration between all the different stakeholders that we mentioned earlier, right? And when we talk about identifying the boundaries of personal data, there's nobody better than the privacy team to understand that they've been data flow mapping for years for different regulations globally, they should be your first stop. second i'd say make sure to involve the service providers early have conversations do you have the right to audit are they aware of these requirements and the timelines so that you know you're not asking those questions you know late in the audit period or even after the audit period okay i think that's a great point well as we wrap up our conversation here maybe any last thoughts I'll turn Mark first to you.

20:12Sure. Yeah. So I think three things that I would kind of highlight here. First of all, organizations should be treating this like a new regulatory audit requirement. I mean, essentially that's what it is and it might sound obvious, but treat it like with importance, early scoping and, you know, performing assessments around this, getting prepared for the real can save a significant amount of time and pain later. So I think that's point number one that i would highlight number two do not reinvent the wheel for this you know and leverage existing reporting that you have across the organization so we touched upon that earlier um but SOC 2 reporting isocervications, NISP maturity assessments, leverage information you have in place for your existing programs as much as possible because that helps drive efficiency and it'll also help identify potential gaps more timely as well from the outset and the third thing i would say is this is not hypothetical an independent audit will surface gaps gaps will be identified observations will be made and it is possible that a regulator could request results you know from these reviewers that are getting done so preparation around this is really critical from my view.

21:30I mean, Chris, what else do you think from your perspective? Yeah, I think historically, when we talk about audits that have been required by regulatory bodies, it's after an incident or after a complaint or investigation where the regulator, whether it's federal, state or otherwise, steps in and mandates it. Now this is a shift. We're seeing a requirement for proactive compliance, right? Being able to demonstrate that you have a program that operates over time and there's evidence to support it. That's a shift for many of our clients, especially with the broad scope that we talked about before.

22:04And then second, I'd say this is just the beginning. California specifically has already explored extending independent audit concepts to other areas and other requirements. Most recently, the data brokers processing requests through the delete request and opt-out platform, the drop platform. So again, if you think about demonstrating and the accountability of your programs, needing to prove that you have those controls in place is just going to continue and expand into other areas. So companies that build integrated governance, reliable evidence, and a repeatable compliance model now will not just be ready for Article 9.

22:43It will be better prepared for where privacy and cyber regulation is going in the future. Okay. Well, that's really helpful. Well, I think obviously very important for companies to understand that the filing date is going to be in 2028. The reporting period will start on January 1, 2027. So coming up soon. And so the time to get ready is now. So thank you both so much for joining me today. Thank you. That's our show for today. Tune in next week for more fresh episodes. So that you never miss any of our audio content, follow the PwC Accounting Podcast, wherever you listen to your podcasts. And to stay up to date on all our latest accounting and reporting news, sign up for our newsletter at viewpoint.pwc.com.

23:31From Thought Leadership at PwC, I'm Heather Horn. Thanks for tuning in.

23:42This podcast is brought to you by PwC, all rights reserved. PwC refers to the U.S. member firm or one of its subsidiaries or affiliates, and they sometimes refer to the PwC network. Each member firm is a separate legal entity. Please see www.pwc.com slash structure for further details. This podcast is for general information purposes only and should not be used as a substitute for consultation with professional advisors, including accountants and lawyers.