Skip to content
Invadel

Compliance

CCPA Audit
Penetration Testing

Testing evidence for the CCPA audit under 11 CCR §§ 7120-7124

Component tests from $4,200, free retest. See all pricing →

Last reviewed

Get a fixed quote

Reply in one business day

Full scoping questionnaire 
Senior certified testers, manual-first185+ years combined experienceOnboarding within 24 hoursFree retest includedOur methodology

When you need it

When you need CCPA audit penetration testing

The situations that bring teams to this engagement, and where it fits alongside the rest of your program.

  • Your 2026 revenue was over $100 million, so your first audit period is calendar 2027 and the report is due by April 1, 2028.
  • Your auditor, internal or external, has asked for penetration test and vulnerability scan evidence for the §7123(c)(6) component.
  • You process the personal information of 250,000 or more consumers or households, or sensitive personal information of 50,000 or more, and need to know where testing fits.
  • You want gaps found and fixed before the audit period closes, so the report records a resolved finding rather than an open weakness.
  • Your SOC 2 or ISO 27001 program already tests every year, and you want that test scoped and dated so it serves the CCPA audit too.

Who and when

Who needs a CCPA audit, and when the first one is due

A CCPA audit, which the regulations call a cybersecurity audit, is required of every business whose processing of personal information presents significant risk to consumers’ security. The California Privacy Protection Agency’s regulations took effect on January 1, 2026, and §7120 defines that risk by revenue and volume. Either test below brings a business in scope.

Test one: selling or sharing data

In the preceding calendar year you derived 50 percent or more of your annual revenue from selling or sharing consumers’ personal information (Civil Code §1798.140(d)(1)(C)).

Test two: revenue and volume

You meet the CCPA’s revenue threshold for a business, $26,625,000 as adjusted from January 1, 2025, and in the preceding calendar year you processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers.

Audit period

Over $100 million for 2026
January 1, 2027 to January 1, 2028
$50 million to $100 million for 2027
January 1, 2028 to January 1, 2029
Under $50 million for 2028
January 1, 2029 to January 1, 2030
Later years
The twelve months from January 1 of any year in which you meet §7120 for the preceding year

Audit report due

Over $100 million for 2026
April 1, 2028
$50 million to $100 million for 2027
April 1, 2029
Under $50 million for 2028
April 1, 2030
Later years
April 1 of the following year, with a signed certification to the Agency

The CCPA reaches businesses that do business in California wherever they are based, so New York companies with California customers can meet these thresholds. Our California penetration testing page covers the state’s other requirements.

Section 7123

What the audit must assess, and the testing that evidences it

Section 7123(c) lists eighteen components the audit must assess where applicable. One names testing outright: “internal and external vulnerability scans, penetration testing, and vulnerability disclosure and reporting.” A well-scoped test also produces evidence for several others, because it shows whether a control held when someone actually attacked it.

What the auditor assesses

(6) Scans and penetration testing
Internal and external vulnerability scans, penetration testing, and vulnerability disclosure
(1) Authentication
MFA, including phishing-resistant MFA for personnel, and strong, unique passwords
(3) Access controls
Least privilege, a limited number of privileged accounts, and privileged access management
(2) Encryption
Personal information encrypted at rest and in transit
(5) Secure configuration
Patching, change management, and securing on-premises and cloud environments
(10) and (11) Segmentation, ports, and protocols
Segmentation of the information system and control of ports, services, and protocols
(7) and (8) Logging and monitoring
Centralized logs, intrusion detection, and data-loss prevention
(17) Incident response
The incident response plan, and how you test your response capabilities

Testing evidence we supply

(6) Scans and penetration testing
Dated external and internal penetration test reports, and validated vulnerability scans
(1) Authentication
MFA coverage and bypass results, password spraying results, and phishing simulation outcomes
(3) Access controls
Privilege-escalation paths through Active Directory and cloud IAM, and authorization testing between application roles
(2) Encryption
Transport encryption findings, and any personal information found unencrypted during testing
(5) Secure configuration
Missing patches confirmed exploitable, and cloud configuration findings
(10) and (11) Segmentation, ports, and protocols
Segmentation results from inside the network, and a list of exposed services
(7) and (8) Logging and monitoring
Whether your logs and alerts recorded our activity, with timestamps to check them against
(17) Incident response
A timeline of the test your team can run its incident response exercise against

The auditor decides which components apply. Section 7123(e) then requires the audit report to describe gaps and weaknesses in detail and to document your plan and timeframe for resolving them, which is why the retest should land before the period ends.

What we assess

What your CCPA audit testing covers

The audit asks how your program protects personal information from unauthorized access, destruction, use, modification, or disclosure. We test the systems that hold it and give your auditor the testing evidence §7123 lists, not a raw scan.

Perimeter & Authentication

Everything internet-facing that leads to personal information, and the sign-in in front of it, including the phishing-resistant MFA §7123(c)(1) names.

We test for

  • Internet-facing host and service discovery
  • VPN, SSO, and remote-access authentication
  • MFA coverage and bypass
  • Password spraying within agreed rules

Applications & APIs

The sites, portals, and APIs that collect consumers’ personal information and send it back out.

We test for

  • Access to another consumer’s records by ID
  • Authorization between roles and tenants
  • Masking of sensitive personal information
  • Encryption in transit

Internal Network & Cloud

How far one compromised laptop or leaked cloud credential reaches toward the stores of personal information.

We test for

  • Least privilege and privileged account paths
  • Segmentation around personal information systems
  • Cloud storage and IAM exposure
  • Ports, services, and protocols left open

Detection & Response

Whether the logging and monitoring the audit assesses actually recorded our activity, which is evidence for how you test incident response.

We test for

  • Audit-log capture of test activity
  • Alerts on unsuccessful logins
  • Data-loss-prevention triggers
  • A timeline for the incident response review

Tester, not auditor

We test. Your auditor audits.

Section 7122 requires a qualified, objective, independent auditor using procedures and standards accepted in the profession of auditing, such as those of the AICPA, the PCAOB, ISACA, or ISO. The auditor can be internal or external, but must not take part in activities it may assess, including making recommendations about the cybersecurity program or running it. A penetration tester recommends fixes, so the roles stay apart.

Your auditor

Sets the audit scope and criteria, assesses the program and each applicable component, and signs the statement of independence §7123(e)(8) requires. It can be an internal audit function that reports to an executive with no responsibility for the cybersecurity program, or an outside firm.

Invadel, the tester

Runs the penetration tests and scans, reports findings with evidence and fix guidance, and retests. The report is part of the specific evidence §7122(d) says audit findings must rest on, in place of management’s assertions.

Your team

Fixes what the testing finds, documents a plan and timeframe for anything still open, and has a member of executive management certify completion to the Agency by April 1.

We do not issue CCPA audit reports or certifications. If a firm already audits your SOC 2 or ISO 27001 program, ask whether it also offers the CCPA cybersecurity audit.

The evidence

What your auditor will want from the testing

  • A test report dated inside the audit period, with a scope statement that matches the information system the audit report describes.
  • The method stated plainly, so the auditor can judge whether the test was thorough enough to rely on.
  • Findings rated by severity and mapped to the §7123(c) components they touch.
  • Remediation and retest evidence, so the audit report can show gaps closed rather than only listed.
  • Scan records on a regular cadence between tests, validated by an analyst rather than exported raw.
  • Tester qualifications and a statement of independence from the systems tested.

Section 7122(g) requires the business and the auditor to keep every document relevant to an audit for at least five years, so the report is written to stand on its own when someone reads it years later. For a year-round program of scans, tests, and retests, see vulnerability management.

Methodology

How we test

Full methodology →

Every engagement follows the Penetration Testing Execution Standard and the relevant OWASP guides.

These are the phases your compliance test runs through.

  1. 01

    Scope the boundary

    The systems your framework actually covers, and nothing you would pay to test twice.

  2. 02

    Test

    The component penetration tests run to PTES and OWASP standards by senior testers.

  3. 03

    Map to controls

    Every finding tied to the requirement or control it evidences.

  4. 04

    Report for the auditor

    Evidence formatted the way your assessor, examiner, or QSA expects to read it.

  5. 05

    Fix & retest

    A free retest so the audit shows closed findings, not open ones.

How it works

How your engagement runs

From scope through the final retest, your team stays in the loop at every step, with findings tracked live in our platform.

  1. 01

    Map the information system

    We scope from where personal information lives: the applications, networks, and cloud accounts your auditor will describe in the audit report.

  2. 02

    Test inside the period

    External, internal, and application testing plus scans, dated inside the twelve months your audit covers.

  3. 03

    Evidence for the auditor

    Findings mapped to the §7123(c) components, in a report your auditor can examine as specific evidence.

  4. 04

    Fix & retest

    Close the findings, then a free retest so the audit report records them resolved.

Fixed prices

What CCPA audit testing costs

Published starting prices, fixed in writing before work begins. Most businesses in scope need the first three.

Components it evidences

External penetration test
(6) testing, (1) authentication, (11) ports and services
Internal penetration test
(6) testing, (3) access controls, (10) segmentation
Web application penetration test
(6) testing, (2) encryption, (14) secure development
Vulnerability scanning
(6) scans, (5) patching and configuration
Cloud penetration test
(3) access controls, (5) cloud configuration

Price

External penetration test
From $4,200, free retest
Internal penetration test
From $6,000, free retest
Web application penetration test
From $5,200, free retest
Vulnerability scanning
$1,500 up to 250 devices, $2,500 up to 1,000
Cloud penetration test
From $6,800, free retest

Every starting price is on our pricing page. Larger estates are quoted from the scope, as one fixed price.

Component tests

The tests behind your CCPA audit evidence

Compliance testing is built from our standard fixed-scope engagements. Each one is scoped to your boundary and reported against the framework.

External penetration testThe external testing and authentication evidence for §7123(c)(6) and (c)(1). From $4,200.Internal penetration testInternal testing, access control, and segmentation around personal information. From $6,000.Web application penetration testThe sites and portals that collect personal information, including authorization between consumers. From $5,200.Vulnerability scanningThe internal and external scans §7123(c)(6) names, validated by an analyst. From $1,500 per scan.Cloud penetration testCloud accounts that store personal information, and their configuration. From $6,800.

Proof

Proof in the field

Every engagement is confidential, so the work below is anonymized to sector and engagement type.

All case studies →

Free

Retest on every penetration test

185+

Years combined experience

14

Senior in-house specialists

24h

Onboarding after signing

HR & Payroll SaaS

Web Application Penetration Test

High risk

Critical: a file-inclusion flaw that let an attacker read sensitive files from the server through the application itself. High: stored cross-site scripting capable of session theft, insecure direct object references, and an authorization bypass that let an administrator create or delete organization owners.

Outcome. Delivered a remediation plan sequenced by real business impact, critical and high findings first, with a complimentary retest to verify every fix.

28

Findings

1

Critical

5

High

Read the case study

Fintech · Payments

Post-Incident Web App Assessment

Medium risk

Excessive data exposure: API responses leaked transaction metadata, including precise geolocation, enabling real-world tracking of users.

Outcome. Surfaced the exposure and hardening gaps, prioritized by how readily an attacker could chain them, and delivered fixes plus a retest to confirm closure.

8

Findings

3

Medium

Post-incident

Engagement

Read the case study
LatentPerygeeCity National BankAubaDesteiaDTCC
Request a reference 

Resources

Field notes from the offensive side

All articles →

Vulnerability Remediation: How to Prioritize, Fix and Prove It

A practical vulnerability remediation guide: how to prioritize with KEV, EPSS and exposure, set fix SLAs, run the workflow, and prove the fix with a retest.

Which Compliance Frameworks Require Penetration Testing?

A framework-by-framework guide to penetration testing for compliance: what SOC 2, PCI DSS, ISO 27001, HIPAA, GDPR, NYDFS and CMMC require, and how often.

Data Breach Fines and Penalties by Law: NYDFS, HIPAA, PCI DSS, GDPR, SEC and New York SHIELD

Data breach fines and penalties under NYDFS Part 500, HIPAA, PCI DSS, GDPR, the SEC rule and New York's SHIELD Act, with the enforcement actions behind them.

Want to see a report first?

Read a sample report for a fictional client, or request a redacted one from a real engagement. Our guide explains what a penetration testing report should contain.

See the sample report

FAQ

Frequently asked questions

What teams most often ask before CCPA Audit testing.

Still have questions? 
01Does the CCPA audit require a penetration test?

Section 7123(c)(6) of the California Privacy Protection Agency’s regulations lists “internal and external vulnerability scans, penetration testing, and vulnerability disclosure and reporting” among the components the cybersecurity audit must assess, where applicable. The auditor decides applicability, and for a business with internet-facing systems and an internal network holding personal information it is hard to argue the component does not apply. The regulations set no testing method or frequency, so the practical standard is a test dated inside the audit period, with the fixes retested.

02Which businesses must complete a CCPA cybersecurity audit?

Those whose processing presents significant risk to consumers’ security under §7120. That means a business that derived 50 percent or more of its annual revenue from selling or sharing personal information in the preceding year, or one that meets the CCPA’s revenue threshold and in the preceding year processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers. The revenue threshold is adjusted for inflation in odd-numbered years and has been $26,625,000 since January 1, 2025.

03When is our first CCPA audit due?

It depends on revenue. A business with 2026 revenue over $100 million audits calendar 2027 and completes the report by April 1, 2028. Revenue between $50 million and $100 million for 2027 means auditing 2028, with the report due April 1, 2029. Revenue under $50 million for 2028 means auditing 2029, with the report due April 1, 2030. After that, a business that meets the §7120 criteria on January 1 audits the next twelve months and completes the report by April 1 of the following year, and a member of executive management certifies completion to the Agency by the same date.

04Can Invadel perform our CCPA cybersecurity audit?

No, and we would not advise using any penetration tester as the auditor. Section 7122 requires a qualified, objective, independent auditor and bars the auditor from making recommendations about the cybersecurity program beyond its audit findings. A test report is full of remediation advice, so we stay the tester. Your auditor, internal or external, examines our report as evidence for the testing component and the other components it touches.

05Can our SOC 2 or ISO 27001 audit count as the CCPA audit?

Possibly, with work. Section 7123(f) lets a business use an audit, assessment, or evaluation prepared for another purpose if it meets every requirement of the Article, on its own or supplemented. The regulation’s own example is an audit using the NIST Cybersecurity Framework 2.0. Most SOC 2 and ISO 27001 audits will need supplementing against the eighteen components and the report contents §7123(e) requires, but one penetration test can be scoped and dated to serve all of them. See SOC 2 penetration testing for how that test is reported.

06We are based in New York. Can the CCPA audit apply to us?

Yes. The CCPA applies to for-profit businesses that do business in California and meet its thresholds, wherever they are headquartered, so a New York company with a large base of California customers or users can meet the §7120 criteria. Your counsel should confirm it. Testing can start while they do, because the same test serves your other frameworks.

07How often should we test for the CCPA audit?

The regulations set no interval. The audit covers twelve months and its findings must rest on specific evidence rather than management’s assertions, so test at least once inside each audit period and scan regularly between tests. Test early enough that the fixes and the retest are also dated inside the period, because the audit report must describe any open gap in detail, with your plan and timeframe to resolve it.

08Does the CCPA require reasonable security even without an audit?

Yes. Civil Code §1798.100(e) requires every business that collects personal information to implement reasonable security procedures and practices, and §1798.150 lets consumers sue when certain personal information is breached because of a failure to do so. Statutory damages have run from $107 to $799 per consumer per incident, or actual damages if greater, since January 1, 2025. Our guide to data breach fines and penalties shows how quickly those figures add up.

09How much does CCPA audit testing cost?

Each component test has a published starting price, fixed in writing before work begins: external testing from $4,200, internal testing from $6,000, and web application testing from $5,200, each with a free retest, plus vulnerability scanning at $1,500 for up to 250 devices. Most businesses in scope need the first three. Every starting price is on our pricing page.

Ready to test your defenses?

Talk to our team about what your CCPA Audit compliance requires.

Prefer the full scoping questionnaire? 
RelatedGDPR SOC 2 ISO 27001

Get a Fixed-Scope Quote

Tell us what you need tested. We reply within one business day.