NY ATTORNEY GENERAL ENFORCEMENT EXPANDED IN 2025
NY SHIELD Act Compliance: Pass the Reasonable Safeguards Test.
The NY SHIELD Act applies to any business holding the private information of any New York resident — not just NY-based businesses. The “reasonable safeguards” standard is what the AG inspects after a breach. We translate the requirements in a 30-minute call. If your current IT can already produce the safeguards evidence, you don’t need us.
Updated May 3, 2026
Who does the NY SHIELD Act apply to?
The Stop Hacks and Improve Electronic Data Security (SHIELD) Act applies to any person or business that owns or licenses computerized data containing the private information of a New York resident — regardless of where the business is located. A Connecticut bookkeeping firm with one NY-resident client is in scope. A Massachusetts manufacturer with NY-resident employees is in scope. Geography does not control applicability; the data does.
Private information under the SHIELD Act is broader than the prior NY breach-notification law. It covers Social Security numbers, driver’s license numbers, financial account numbers, biometric data, username/email plus password or security question, health information, and the combination of name with any of the above. Any breach of these categories triggers notification.
Reasonable safeguards is the operational standard. The Act requires administrative, technical, and physical safeguards appropriate to the size, complexity, sensitivity of data, and operational context. The safeguards must be implemented, documented, and subjected to risk assessment. The vague “reasonable” standard is what AG investigators use as their hook during post-breach inquiry.
Small business carve-out exists but is narrow. Businesses with fewer than 50 employees, less than $3 million in annual revenue, and less than $5 million in year-end assets are considered small businesses for SHIELD safeguards purposes. They still must implement safeguards reasonable for their size; they get latitude on specifics. Most professional services and B2B firms exceed at least one threshold.
What does the New York AG actually inspect after a breach?
The AG’s Bureau of Internet and Technology inspects four artifacts after a breach notification: the breach notification submitted to NY consumers and the AG, the written information security program documenting administrative/technical/physical safeguards, the risk assessment showing how safeguards match the firm’s data sensitivity, and the incident response evidence covering the breach itself.
The breach notification timing is structured. NY residents must be notified “in the most expedient time possible and without unreasonable delay” consistent with law enforcement investigation needs. The AG, the Department of State, and the Division of State Police must be notified for breaches affecting 500+ NY residents. For breaches affecting 5,000+ residents, consumer reporting agencies must also be notified.
The written security program is the artifact most firms miss. SHIELD Act §899-bb requires a written program covering specific elements: designating responsible employees, identifying internal and external risks, assessing the sufficiency of safeguards, training and managing employees, vendor due diligence, and adjusting the program based on changes. The “we have controls” attestation without the written program is a finding.
Compliance is a snapshot, not a destination. The risk assessment from three years ago does not protect you today — your data, your systems, your vendors, and the threat landscape all moved while you focused on operations. The AG looks for current safeguards mapped to current risk, not a frozen artifact from initial implementation.
What happens if you fail a SHIELD Act safeguards inspection?
AG enforcement under §899-bb is civil. Penalties run up to $5,000 per violation, with violations counted per affected resident in many enforcement actions. A breach affecting 10,000 NY residents with inadequate safeguards is potentially $50 million in theoretical exposure — actual settlements have been substantially lower but typically $200,000-$2 million for SMB defendants in published 2024-2025 actions.
The path is mechanical. Breach occurs. Notification submitted to NY AG and affected consumers. AG opens inquiry with document request — typically the written security program, risk assessment, vendor management evidence, and incident response evidence. Inadequate response triggers Assurance of Discontinuance negotiation (settlement) or civil action.
The compounding consequence is reputation. AG settlements are public; the consumer-facing narrative around an SMB that “failed to implement reasonable safeguards” affects customer retention, vendor relationships, and recruiting. The legal cost of the settlement is often less consequential than the trust cost.
For multi-state firms, NY enforcement creates precedent that tracks. The AGs in Connecticut, Massachusetts, and New Jersey monitor each other’s enforcement and frequently parallel NY actions when the underlying defendant operates across the region. Fix-it-once across states is the operational answer.
How does Triton get your firm SHIELD Act-ready?
We deploy Sophos Endpoint XDR, Microsoft Defender for Endpoint, Sophos Firewall enforcing segmentation, and AWS-backed immutable backup. We then author the written information security program covering all §899-bb required elements, the risk assessment documenting how safeguards match data sensitivity, the vendor management procedures, and the incident response plan with NY-specific notification timing built in.
The stack matters because the SHIELD Act’s reasonable-safeguards standard defaults to industry norms. Sophos endpoint XDR + Microsoft Defender MFA + AWS-backed tested backup is the SMB industry norm. A controller without those controls argues uphill against AG investigators citing what reasonable comparators implement.
We deploy on AWS because downtime is not an option. When a critical system goes down — including during incident response — AWS support responds with enterprise urgency. Every hour of downtime during a breach is an hour of additional regulatory exposure.
Our typical SHIELD Act engagement delivers the written security program, risk assessment, vendor management procedures, and technical stack inside 60 days. We coordinate with outside counsel for the program review and the breach-counsel relationship — having a breach-counsel relationship pre-existing is itself a SHIELD-aligned safeguard.
What evidence does the NY AG actually want on file?
Six artifacts the AG inquiry will request, each mapping to §899-bb required elements.
Why start now? Because AG inquiries don't wait for you to assemble evidence.
When a breach occurs and notification triggers, the AG inquiry begins within weeks. There is no readiness window after the fact. The written security program either exists or it doesn’t. The risk assessment is either current or it isn’t. Building the evidence file under post-breach pressure costs 2-3x what proactive readiness costs.
NY-touching firms across the Northeast that we have helped through SHIELD readiness started before any breach. The firms that started after a breach paid for outside counsel, forensic investigators, and emergency program authoring simultaneously — while consumer notifications and AG response timelines compressed every week.
Frequently Asked Questions
Does SHIELD apply to my CT firm with NY-resident clients?
Yes. SHIELD applies based on whose data you hold, not where you operate. A Connecticut firm with even one NY-resident customer or employee with private information is in scope for that data. Most multi-state firms across the Northeast hold NY-resident data and are in scope.
How does small-business carve-out work?
A business is “small” under SHIELD if all three: under 50 employees AND under $3M annual revenue AND under $5M year-end assets. Small businesses still implement safeguards but with latitude on specifics — the standard is “appropriate to size, complexity, and sensitivity.” Most professional services and B2B firms exceed at least one threshold and are in the standard track.
Does GLBA exempt our firm from SHIELD?
Partial. GLBA-covered financial institutions and HIPAA-covered entities are exempt from SHIELD safeguards requirements for the data those laws cover. They remain subject to SHIELD breach notification requirements. Non-GLBA, non-HIPAA data handled by these firms (employee data, marketing data) remains in SHIELD safeguards scope.
What is the breach notification timing?
NY residents must be notified “in the most expedient time possible without unreasonable delay” consistent with legitimate law enforcement investigation. AG, Department of State, and Division of State Police must be notified for breaches affecting 500+ NY residents. Notifications to consumer reporting agencies are required for breaches affecting 5,000+ residents.
What does SHIELD readiness cost?
Total readiness investment for a 25-100 employee NY-touching firm typically runs $20,000 to $50,000 in the first year. The split: written security program and policy authoring ($6-15K), risk assessment ($4-10K), technical security stack ($8-18K), vendor management procedures ($2-7K).
Can outside counsel write our written security program?
Counsel reviews and approves the program; the operational content typically comes from the IT and operations teams. The most defensible programs are joint products — counsel handles the legal framing and AG-facing language, IT and operations document the actual safeguards in place. Triton produces the technical and operational evidence; counsel wraps it in the program document.
Do we need cyber insurance to comply with SHIELD?
SHIELD does not require cyber insurance. Insurance does not satisfy the safeguards requirement — it covers financial loss, not the regulatory requirement to implement safeguards. Most firms carry cyber insurance for the financial protection and implement SHIELD safeguards independently. The two are complementary, not substitutes.
Do we need dark web monitoring for SHIELD?
No. Dark web monitoring is a notification service, not a SHIELD safeguard. The Act requires administrative, technical, and physical safeguards — endpoint protection, MFA, encryption, audit logging, incident response. Dark web alerts do not satisfy any of these categories. We do not bundle dark web monitoring and it does not appear in any SHIELD evidence list.
Founded in 2001
25 Years of IT Expertise
Worcester · Providence · Hartford
Regional Offices
Ranked 84th Percentile Nationally
National Benchmark
Under 10 Minute Response
Third-Party Verified
HIPAA · CMMC · SOC 2 · PCI
Multi-Framework Compliance
Let's Discuss Your IT Needs
Triton Technologies delivers managed IT services, cybersecurity, and IT support for businesses across Connecticut, Massachusetts, New York, Rhode Island, and beyond. Contact our team today to start a conversation about your technology environment.
