October 17, 20263 min read
California passed a rule that requires some businesses to carry out a yearly cybersecurity audit. If you run a small business, you have probably heard a version of this and are not sure whether it applies to you. Here is the plain version.
This is a general guide, not legal advice, and the details can change, so confirm anything specific with the current regulation or a lawyer before you act on it.
What the rule is
Under the California Privacy Rights Act, the state's privacy agency now requires businesses whose handling of personal information carries a real risk to run an annual cybersecurity audit. The audit has to be done by someone qualified and independent, and the business files a yearly certification that it was done.
The important word is independent. The person who built or runs your security cannot be the one who signs off that it is sound. That is the whole point of an audit.
Who it actually covers
This is where most small businesses can relax a little. The rule bites at real size. In broad terms it reaches a business only if it is large enough to fall under the state privacy law in the first place, and it handles personal information on a large scale, think hundreds of thousands of people, or sensitive information on tens of thousands.
A single bakery, dental office, or contractor is nowhere near those numbers. So the annual audit mandate probably does not apply to you directly. What does reach smaller businesses are the federal rules for specific fields: healthcare practices under HIPAA, and many finance related businesses under the federal Safeguards Rule, both of which expect security risk assessments.
When it starts
The audit requirement phases in by size over the next few years, with the largest businesses first and smaller covered businesses later. So even for the businesses it does cover, there is runway. The underlying expectation, that you actually protect the personal information you hold, applies now regardless.
What a small business should do about it
Even if the formal audit does not apply to you, the direction is clear: California expects businesses to take security of personal information seriously, and your customers and partners increasingly expect the same.
Here is the sensible response at your size:
- Know what personal information you hold and where it lives. You cannot protect what you have not mapped.
- Do a security assessment once, properly. Not a formal audit, a straightforward check of your computers, network, backups, and the information you keep, with a clear list of what to fix.
- Keep it current. A one time fix drifts. A light check every quarter keeps you ahead of it, and gives you something to show an insurer or a bigger customer who asks.
If a larger customer or a contract ever does require a formal audit or a readiness report, having already done the groundwork means you walk in ready instead of starting from zero.
Where local businesses stand today
The Bakersfield Cybersecurity Report measured 4,406 independent Bakersfield businesses in October 2026. Fewer than 1 in 11 passed five basic checks that cost nothing to fix, and 86% had not published an enforced DMARC policy, the instruction that tells mail servers to reject fake email sent in their name. Any audit, required or not, would start there.
The takeaway
The new rule is aimed at bigger companies, so most small businesses in Kern County do not need to panic about an annual audit. But it is a signal of where things are heading, and the smart move is the same one that protects you from the everyday threats anyway: find your weak spots, fix them, and keep an eye on them.
If you want a plain picture of where you stand, our assessment does exactly that, in plain English, with numbered steps you can tick off. Start with the free check to see what is already visible from the outside.
See where your business stands
The free check shows what anyone on the internet can already find out about you. It takes a minute and costs nothing.