Governance, risk & compliance
CPPA regulations: cybersecurity audits, risk assessments, ADMT 11 CCR Div. 6 Ch. 1, eff. 1 Jan 2026
The California Privacy Protection Agency regulations (Title 11 CCR, Division 6, Chapter 1) that add three programs to the California Consumer Privacy Act: independent cybersecurity audits, risk assessments, and automated decision-making technology (ADMT).
The Agency Board adopted the package on 24 July 2025; the Office of Administrative Law approved it and it was filed with the Secretary of State on 22 September 2025; it took effect on 1 January 2026. How it relates to the CCPA: the CCPA framework (code CCPA) is the statute and the consumer rights it creates.
This framework is the Agency rulebook made under it, and it assumes you already meet the CCPA. Use both: CCPA for the rights and notices, CA_CPPA_REGS for the audit, assessment and ADMT duties and their dates.
Dates in the regulations: cybersecurity audit reports are due 1 April 2028 (2026 gross revenue over $100 million), 1 April 2029 ($50 million to $100 million for 2027) or 1 April 2030 (under $50 million for 2028), and then every year (s. 7121).
Risk assessments must be done before the processing starts, and an assessment of processing already under way on 1 January 2026 is due by 31 December 2027 (s. 7155); the first submissions to the Agency are due 1 April 2028 (s.
7157). ADMT duties (pre-use notice, opt-out, access) must be met by 1 January 2027 (s.
7200(b)). Each business applies the thresholds itself (s.
7120 for audits, s. 7150 for assessments, s.
7001 for ADMT); read the regulation text before relying on a summary. General information for compliance work, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses CPPA regulations: cybersecurity audits, risk assessments, ADMT at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Cybersecurity audits | Businesses over the s. 7120 thresholds: an independent cybersecurity audit each year, a report to the board or executive, and an annual certification to the Agency. First reports due 1 April 2028, 2029 or 2030 depending on revenue (s. 7121). | — |
| Risk assessments | Businesses whose processing meets one of the six triggers in s. 7150(b): selling or sharing personal information, sensitive personal information, ADMT for significant decisions, certain automated inference, sensitive-location inference, and training ADMT or facial or emotion recognition. | — |
| ADMT decisions | Businesses that use ADMT to make or substantially replace human decision-making about a significant decision. Pre-use notice, opt-out and access must be in place by 1 January 2027 (s. 7200(b)). | — |
| Insurance companies | Insurance companies subject to the CCPA: ss. 7270 and 7271 set how the CCPA applies to them. Read with Insurance Code s. 791 et seq. (CA_STATE, Insurance tier). | — |
How Lavawall® helps you get to CPPA regulations: cybersecurity audits, risk assessments, ADMT compliance
Most of CPPA regulations: cybersecurity audits, risk assessments, ADMT comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to CPPA regulations: cybersecurity audits, risk assessments, ADMT, and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against CPPA regulations: cybersecurity audits, risk assessments, ADMT in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports CPPA regulations: cybersecurity audits, risk assessments, ADMT as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- CPPA regulations: cybersecurity audits, risk assessments, ADMT 11 CCR Div. 6 Ch. 1, eff. 1 Jan 2026
- Category
- Privacy
- Region
- USA - California
- Levels
- 4 assessment tiers
All California, United States frameworks and training →
Map this framework freeTalk to our team