Managed IT and Cybersecurity for Albany and the Capital Region

Any business that owns or licenses private information of a New York resident falls under the SHIELD Act (General Business Law 899-aa and 899-bb). It must keep reasonable administrative, technical and physical safeguards, and since a December 2024 amendment it must notify affected New Yorkers within 30 days of discovering a breach. Medical and health insurance information now count as private information. Businesses with fewer than 50 employees, under $3 million in revenue or under $5 million in assets still need safeguards, sized to the business. The Attorney General enforces the law.

The safeguards the law lists as examples include:

• a designated employee who coordinates the security program
• risk assessments and regular testing of key controls
• employee security training and vendor oversight written into contracts
• secure disposal of private information when it is no longer needed

Banks, insurers and other firms licensed by the Department of Financial Services also answer to 23 NYCRR Part 500. Since November 1, 2025, multi-factor authentication is required for anyone accessing their information systems, with narrow exceptions. Covered entities must report qualifying cybersecurity incidents to DFS within 72 hours and file an annual compliance certification by April 15.

Medical practices and their business associates follow the HIPAA Security Rule’s administrative, physical and technical safeguards. Firms that do state work should expect their contracts to carry state requirements too: New York’s information security policy (NYS-P03-002) extends to vendors and contractors that use state IT resources.

Triton builds the controls each framework calls for inside the environment we manage, keeps the audit trail current all year, and produces the documentation regulators and auditors ask for. Details: NY SHIELD Act and NYDFS 23 NYCRR 500.