RhymetecNew York, NY, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
CCPA/CPRA
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, is California's general privacy law for for-profit businesses that handle personal information about California residents.
It creates consumer rights (to know, delete, correct, opt out of sale or sharing, and limit use of sensitive data) and obligations for businesses, service providers and contractors.
Regulations approved on September 22, 2025 and effective January 1, 2026 added three major obligations: documented privacy risk assessments for high-risk processing, annual independent cybersecurity audits for larger businesses, and rules for automated decision-making technology (ADMT), whose consumer-facing requirements apply from January 1, 2027.
What must exist in writing: a privacy policy and notice at collection, a documented process for handling consumer requests within the statutory deadlines, service provider and contractor contracts with the required terms, records of requests and responses, risk assessments for covered processing (with the first attestation and summaries due to CalPrivacy by April 1, 2028), and, for businesses over the audit threshold, an annual cybersecurity audit report by an independent auditor with a certification of completion filed with CalPrivacy on a phased schedule starting April 1, 2028.
Latest: New CCPA rules: risk assessments, audits and ADMT dates →
Share
Ad from the publisher
Policy Acknowledgment Proof
AcknowledgedPrivacy procedure v3by name, on record
Do Not Sell Do Provewith AllyMatter
Opt In the Modern WayEvery privacy procedure, acknowledged by the staff who handle requests
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every request handler on record
Who read which version, and when
03
Show the agency the trail
From $29/mo, 20 editors, unlimited staff (published)
Who has to comply
For-profit businesses doing business in California that meet one of three thresholds: annual gross revenue above $25 million (inflation-adjusted; $26.625 million from January 1, 2025), buying, selling or sharing personal information of 100,000 or more California consumers or households, or deriving 50 percent or more of revenue from selling or sharing personal information.
Service providers and contractors are bound by contract. The cybersecurity audit applies to businesses over the revenue threshold that process personal information of 250,000 or more consumers or households or sensitive information of 50,000 or more, and to businesses earning half or more of their revenue from selling or sharing.
What the assessor asks to see
Privacy policy and notices at collection; data inventory and processing purposes; consumer request logs with response times and metrics; opt-out and Global Privacy Control handling records; service provider and contractor agreements; risk assessment documents for each covered activity; ADMT pre-use notices and opt-out records; cybersecurity audit scope, auditor independence statement, audit report and the certification filed with CalPrivacy; breach response records.
Where the requirement sits: Cal. Civ. Code 1798.130(a)(5)-(6); regs 11 CCR 7102 record-keeping; CalPrivacy regulations effective January 1, 2026: 11 CCR 7120-7121 (cybersecurity audits), 7150-7157 (risk assessments) and 7200 (ADMT)
2026 regulations
CalPrivacy's regulations on risk assessments, cybersecurity audits and ADMT were approved by the Office of Administrative Law on September 22, 2025 and took effect January 1, 2026.
A covered processing activity that starts on or after January 1, 2026 needs its risk assessment before it begins; activities that began before 2026 and are still running must be assessed by December 31, 2027. The first risk assessment attestation and the first cybersecurity audit certification for the largest businesses are both due April 1, 2028.
ADMT consumer rights apply from January 1, 2027.
Every internal policy in one place
AllyMatter is a full system for every internal policy your company keeps. Build the whole library in one place, across every department, and prove who has read what.
Start here
Written Information Security Plan: who needs it, what goes in it, how often it is reviewed and who signs it off. Run exactly that in AllyMatter, alongside every other policy your company keeps.
How it works
Every document is approved by someone other than its author, versioned, distributed to the people it covers and acknowledged by name. Sign it where a signature is what the standard wants, send a set out together as a package, and export a dated record of who read which version when an assessor asks.
Who helps with CCPA/CPRA
A large ecosystem: privacy law firms, privacy consultancies and consent and data-mapping platforms. They build data inventories, write notices and policies, draft risk assessments and contract terms, and, for the audit rule, engage audit firms. Cybersecurity audit work is emerging among CPA and security assessment firms.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
Silent SectorUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
TruvantisSan Francisco, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
CisoshareSan Clemente, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Neutral PartnersOrlando, Florida
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
TestprosSterling, Virginia
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
FRSecureEdina, Minnesota, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, SOC 2, HIPAA, PCI DSS, CMMC and more.
- Standards
- Pricing
- Not published
ConsilienTorrance, California, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Omega SystemsUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
VISTA InfoSecMumbai, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
IsecurionBengaluru, Karnataka, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Adviser Compliance ConsultingUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, GDPR, SEC 206(4)-7. Named as outsourced chief compliance officer by 9 SEC-registered investment advisers in 2023 to 2024 Form ADV filings.
- Standards
- Pricing
- Not published
Alpha Epsilon LLCUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
AmomittoUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, HIPAA, CMMC, PCI DSS, GDPR and more.
- Standards
- Pricing
- Not published
Compass IT ComplianceNorth Providence, RI, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, CMMC, NIST 800-171, PCI DSS, GDPR and more.
- Standards
- Pricing
- Not published
Control LogicsTampa, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, HIPAA, GDPR and more.
- Standards
- Pricing
- Not published
CYBRINew York, NY, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, HIPAA, GDPR, NYDFS 23 NYCRR 500.
- Standards
- Pricing
- Not published
LatacoraRemote, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, HIPAA, GDPR.
- Standards
- Pricing
- Not published
Prodigy 13New York, NY, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, HIPAA, PCI DSS, GDPR, FedRAMP and more.
- Standards
- Pricing
- Not published
RSI SecuritySan Diego, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
Vertex11Ashburn, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, SOC 2, HIPAA, CMMC, GDPR and more.
- Standards
- Pricing
- Not published
Audit Liaison, LLCTampa, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 9001, HIPAA, CMMC, PCI DSS and more.
- Standards
- Pricing
- Not published
Deura Information Security ConsultingPetaluma, California, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, HIPAA, PCI DSS, GDPR, NIST CSF and more.
- Standards
- Pricing
- Not published
Cyberverse Pty LtdVictoria, Australia
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, ISO 9001, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
CyberSurance, Inc.Westlake Village, California, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, GDPR, ISO 22301.
- Standards
- Pricing
- Not published
Glocal Insight LLCKansas City, MO, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, SOC 2, ISO 9001, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
My ISO ConsultantsCrestline, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, SOC 2, ISO 9001, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Next Practice Management (NPX)Brisbane, QLD, Australia
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, ISO 9001, PCI DSS and more.
- Standards
- Pricing
- Not published
UniSense AdvisoryGurugram, Haryana, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, HIPAA, GDPR, NIST CSF and more.
- Standards
- Pricing
- Not published
Veave Technologies Pvt. Ltd.Bangalore, Karnataka, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, ISO 9001, HIPAA and more.
- Standards
- Pricing
- Not published
CyberCrestEncinitas, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, SOC 2, ISO 9001, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
BH ConsultingDublin 15, Ireland
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, PCI DSS, GDPR, NIST CSF, ISO 42001 and more.
- Standards
- Pricing
- Not published
Intrix Cyber SecuritySydney NSW and Melbourne VIC, Australia
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
RB Advisory LLCWinter Park, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Socium SecuritySan Clemente, California, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Assured InformationUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Alliant CybersecurityHouston, TX, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
Assured Information Solutions LLCChallis, ID, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
CompassMSPWest Hartford, CT, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
ConcertiumTampa, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Concordant LLCLaramie, WY, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, CMMC, NIST 800-171, PCI DSS, GDPR and more.
- Standards
- Pricing
- Not published
DTSArlington, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
CorporateTechIrvine, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, SOC 2, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
CSM International LLCCollegeville, PA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, HIPAA, CMMC, GDPR.
- Standards
- Pricing
- Not published
Strattmont GroupBryan, TX, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, SOC 2, HIPAA, CMMC, PCI DSS and more.
- Standards
- Pricing
- Not published
Systems EngineeringPortland, ME, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
ZaviantPhiladelphia, PA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Tego Data SystemsRaleigh, NC, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
Crafted Compliance, Inc.Ormond Beach, Florida, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA/CPRA, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Layer 8 Security, LlcMalvern, Pennsylvania, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
Mbl Technologies, Inc.Herndon, Virginia, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, HIPAA, GDPR, NIST CSF, FISMA and more.
- Standards
- Pricing
- Not published
Relic Law PLLCBrighton, Michigan, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
CyberAccord
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, HIPAA, NIST 800-171 and more.
- Standards
- Pricing
- Not published
ElastifyToronto, Ontario, Canada
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Jones ITSan Francisco, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Digital SilenceDenver, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, GDPR.
- Standards
- Pricing
- Not published
ITASC SolutionsCalifornia, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
ForgePath SecurityNorfolk, Virginia, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CCPA, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Who assesses CCPA/CPRA
No certification. Enforcement is by CalPrivacy and the Attorney General through investigations and administrative or civil actions.
The cybersecurity audit must be performed by a qualified, objective, independent professional (internal or external) using accepted auditing standards, and the business certifies completion to CalPrivacy; the audit is not a government-issued approval. CalPrivacy sets the audit and risk assessment rules; auditors are not registered or accredited by the state.
Assessors
Be the first CCPA/CPRA assessor listed here
This page is read by the organizations looking for someone to certify them.
Tools for CCPA/CPRA
Tools that name this framework in their own material.
Grouped by type. Inside each group the order is random, reshuffled each time the page loads. AllyMatter, the publisher of this site, is always first.
AllyMatterPolicy management tool, the policy and acknowledgment layerPublisher of this siteGRC and compliance automation11 tools
Controls, evidence and audit workflows, with a policy module inside.
SecureframeCompliance automation platform with in-house compliance expertsPrice publishedScytaleCompliance automation platform with a compliance-expert serviceNot publishedStrike GraphAI-native GRC and compliance automation platformPrice publishedCompylAI GRC and compliance automation platformNot publishedProboOpen-source compliance automation platform with a done-for-you serviceNot publishedComp AICompliance automation platformQuote onlyOneTrustGRC platform for privacy, consent, AI governance and third-party riskNot publishedRegbaseAI regulatory-tracking research platformNot publishedTrustCloudAI-native GRC and cyber risk assurance platformQuote onlyheygrcCompliance code review for pull requestsPrice publishedOstendioGRC and security compliance platformPrice published
Privacy and data governance9 tools
Consent, data maps and data subject requests under GDPR, CCPA and similar laws.
BigIDData security and compliance automation platformNot publishedDataGrailData privacy compliance platformNot publishedKetchSan Francisco, CA, United StatesData privacy and consent management platformPrice publishedLokkerWebsite privacy intelligence platformNot publishedOsanoAustin, TX, United StatesData privacy management platformQuote onlyRelyance AIPrivacy automation and data governance platformNot publishedSecuritiSan Jose, CA, United StatesData security, privacy and AI governance platformQuote onlyStracData loss prevention and data security posture management platformQuote onlyTrustArcWalnut Creek, CA, United StatesData privacy management and governance platformNot published
Compliance training1 tool
Courses and tracking for required staff training.
Related reading
- California's CCPA cybersecurity audit rule takes effect: what businesses need to knowExplains which businesses hit the audit threshold, who may perform the audit, and the staggered first-report deadlines.Ropes & Gray
- Plan ahead: updated CCPA regulations go into effect January 1Covers the risk assessment, automated decision-making and audit rules together, with the documentation each one expects.Paul Hastings
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Sources
CalPrivacy: CCPA regulations effective January 1, 2026, Cal. Code Regs. tit. 11, § 7000 et seq.CalPrivacy: rulemaking record for cybersecurity audits, risk assessments and ADMTCalifornia Consumer Privacy Act, Civil Code 1798.100 et seq. (effective January 1, 2026)CalPrivacy: updated monetary thresholdsCalifornia Attorney General: CCPA overview
Need a hand implementing it?
Find a Consultant for CCPA/CPRA
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Run the Policy Side of CCPA/CPRA in AllyMatter
Approve the policies CCPA/CPRA asks for, keep every version, and record a named acknowledgment from each person who has to read them.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff