SynchroNet the NY Shield Act

What does NY Shield Act mean for you?

NY Shield is Here to

On July 25th, 2019, New York’s governor signed the Stop Hacks and Improve Electronic Data Security (“SHIELD”) Act into law. NY SHIELD amends the state’s existing data breach notification law. It also expands the definition of protected data to now include biometric information. This adjustment levels up with changing times as we use fingerprints, iris/retina images, voiceprints, and more to authenticate our identities. However, the language of NY SHIELD is deliberately vague. It presents 14 “reasonable” requirements in three broad categories. The goal of NY SHIELD is to allow each organization to determine how best to meet these requirements. That’s not to say that NY SHIELD has no teeth: Covered businesses may be liable for a civil penalty for knowing or reckless violations of up to $5,000 per violation. The maximum penalty grew 250%, from $100,000 to $250,000. As an expert IT partner to SMBs in New York and beyond, we’ve fielded a lot of questions about NY SHIELD: “What does SHIELD mean for a so-called small business versus a large business?” “Who’s going to decide if I’m compliant?” “Do I really have to worry about NY SHIELD?” So, where should you get started? Here’s what NY SHIELD requires in plain English.

Download your free copy of the “NY SHIELD Reference Guide: 14 Requirements in Plain English” now.

“Reasonable” Administrative Safeguards

"Reasonable" Technical Safeguards

Assess risks in network and software design. Translation: Figure out how and where your corporate internet, files, and applications are fragile, vulnerable, or threatened before the criminals do. You care about who has access, how that access is validated, and what access allows each user to do.
Assess risks in information processing, transmission, and storage. Translation: Consider where things could go wrong as you work with, share, and save data. Do you regularly email protected data? Encrypt those emails. Save your active work files into restricted folders instead of to your desktop. Ensure you save backups in a secure format and location.
Detect, prevent, and respond to attacks or system failures. Translation: Install defensive architecture (like firewalls, anti-virus/anti-malware, and email spam filters), review logs and alerts, and take immediate action on issues. If possible, install a real-time security information and event management system (“SIEM” software is proactive!). If the budget doesn’t allow for SIEM, upgrade your firewall to include intrusion detection to give you as much information about attacks and failures as possible.
Regularly test the effectiveness of critical controls. Translation: Stage a mock disaster or breach event and see if your team can follow cybersecurity procedures in a timely and complete way. Table tests are like fire drills; they help you determine if you’ve documented all the essential steps so that everyone knows what to do in a crisis. Don’t forget to review access controls each quarter to make sure that only those who should have access do have access.

"Reasonable" Physical Safeguards

Assess the risks of information storage and disposal. Translation: Write a policy that explains how you’ll safeguard your physical equipment (like computers, laptops, and servers) throughout their lifecycle from procurement to recycling.
Detect, prevent, and respond to intrusions. Translation: Not all intrusions happen after hours by thieves wearing masks. Your physical security policy should address how you’ll avoid the deliberate or accidental access to unauthorized areas by employees, vendors, or strangers at best; or deal with that access at worse.
Prevent unauthorized access to (or use of) private information during or after its collection, transportation, and destruction or disposal. Translation: Keep your protected data safe, no matter what. Put the server that houses your applications and backups in a locked room. Make sure it has a screen timeout and is password protected. When it’s time to upgrade your hardware, shred your old hard drives.
Dispose of private information within a reasonable amount of time by erasing electronic media so that data cannot be read or reconstructed. Translation: If you no longer need data for business purposes, shred the drive. Don’t hang on to protected information for decades. Don’t leave old computers in the storage room. Keep what you need to meet the obligations of your daily business and industry and no more.

So, Now What?
As an SMB, do you need to take NY SHIELD seriously? The short answer is, YES. Your compliance – or lack thereof – will only be a factor in the case of breach when the full weight of SHIELD’s penalties will come to bear. NY SHIELD is good for New York businesses, and it’s smart for your business. Each item in the regulation reflects best practices. You determine how best to comply based on your budget, your industry, the types of data you touch, and your risk tolerance.

Our best advice is this: Do what you can, do all that you can, and don’t let cybercriminals turn your business into another statistic.

Book a Quick Meeting

Curious To See How Stack up to NY Shield?

Schedule your free NY SHIELD Audit to get your company’s compliance report card.

Book a Quick Meeting

NY Shield Act Explained

Not Convinced NY Shield Needs Your Full Attention?

Play Video

More Free Tools to Help You

At SynchroNet, we take our role as trainers seriously. As WNY’s favorite expert IT partner, we’re here to help SMBs just like you understand what regulations mean for your business. If you’d like more information (and a few laughs) about NY SHIELD, check out our free six-video series, the NY SHIELD Crash Course.

Watch Now