Compliance FrameworksAmericas
NY SHIELD Act
NY Stop Hacks and Improve Electronic Data Security Act - reasonable safeguards, breach notification.
NY Stop Hacks and Improve Electronic Data Security Act - reasonable safeguards, breach notification.
| Short name | SHIELD |
| Region | Americas |
| Country or scope | United States |
| Sector | Privacy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers SHIELD
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below, plus 11 controls from Safeguard's control catalog for SHIELD.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 24: 2 written for SHIELD and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
NY-SHIELD-899BB Reasonable Technical Safeguards | Businesses must develop, implement, and maintain reasonable safeguards to protect the security, confidentiality, and integrity of private information, which implies integrity assurance over the software systems processing it (NY GBL s.899-bb(2)) | Scan |
NY-SHIELD-SWDESIGN Software and Network Risk Assessment | The statute's technical safeguards include assessing risks in network and software design and in information processing, which requires knowing exactly which software components and versions are deployed (NY GBL s.899-bb(2)(b)(ii)(B)) | Scan |
NY-SHIELD-RISKID Identification of Foreseeable Risks | Administrative safeguards include identifying reasonably foreseeable internal and external risks, a task that presupposes an enumerated inventory of the systems and software holding private information (NY GBL s.899-bb(2)(b)(ii)(A)) | Scan |
NY-SHIELD-VENDOR Service Provider Selection | Safeguards include selecting service providers capable of maintaining appropriate protections and requiring those safeguards by contract, which depends on knowing the supplier behind each component and service in use (NY GBL s.899-bb(2)(b)(ii)(A) service-provider element) | Scan |
NY-SHIELD-899AA Breach Notification Readiness | Breaches of private information must be disclosed to affected New York residents and authorities; determining whose data was exposed and through which system requires individually identifiable components (NY GBL s.899-aa) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
SHIELD-ADMIN-1 | Administrative Safeguards |
SHIELD-ADMIN-2 | Employee Training & Management |
SHIELD-ADMIN-3 | Vendor & Third-Party Oversight |
SHIELD-TECH-1 | Technical Safeguards: Access Controls |
SHIELD-TECH-2 | Technical Safeguards: Encryption & Intrusion Detection |
SHIELD-PHYS-1 | Physical Safeguards |
SHIELD-PHYS-2 | Secure Disposal of Private Information |
SHIELD-BREACH-1 | Breach Notification |
SHIELD-PROG-1 | Reasonable Security Program |
SHIELD-PROG-2 | Program Evaluation & Adjustment |
SHIELD-SCOPE-1 | Scope of Private Information |
Policy templates
Written for SHIELD:
- NY SHIELD Act Information Security Program
- NY SHIELD Act Breach Notification Procedure
And 22 from the standard set, adapted to SHIELD.