We're not in New York. Does the SHIELD Act apply?

It can. The duty follows the data, not the office: it applies to a business that owns or licenses computerized data with private information about a New York resident. A startup in another state with New York customers is inside it. The attorney general enforces the section, and the statute creates no private right of action.

Are small companies exempt from Part 500?

Part 500 has limited exemptions for smaller covered companies, in section 500.19. They lift some requirements and keep others, and the company files a notice to claim them. I recommend reading the current text with counsel before relying on one. The thresholds changed with the 2023 amendments.

What would you build first?

Multi-factor authentication on every sign-in, because both rules and every vendor contract ask for it. Then an inventory of where private information sits, and logging that can show who touched it. Which of those three would be hardest to show for your platform today?

All guides

Guide

New York cybersecurity rules for startups

What New York's DFS cybersecurity regulation (23 NYCRR Part 500) and the SHIELD Act ask of a startup's cloud platform, and how they reach vendors.

New York has two security rules a startup is likely to meet. The first is the Department of Financial Services cybersecurity regulation, 23 NYCRR Part 500. It applies to companies that DFS licenses or regulates, such as banks, insurers, lenders, and money transmitters. The second is the SHIELD Act, whose safeguards duty sits in General Business Law section 899-bb.

I'm starting to see the two reach companies by different routes. Part 500 reaches a startup directly when it holds a DFS license, and through a contract when it sells to a company that does. The SHIELD Act reaches any business that holds private information about a New York resident, wherever the business is. I wrote this guide for the platform that has to answer both.

This is an engineer's reading of the rules. I wrote it to help teams decide whether the rules touch their platform. It isn't legal advice. I recommend checking the current text with your own counsel before planning around a date or a threshold.

Does it apply to you?

If one of these lines describes your company, the rest of this guide applies. If none does, the rule probably sits outside your company. A thirty-minute call confirms that faster than the text can.

We hold a license or registration from the New York Department of Financial Services, or we're applying for one.
We sell software or a service to a bank, an insurer, or a lender that DFS regulates, and their vendor contract carries security terms.
We own or license computerized data that includes private information about New York residents, such as a name with a Social Security number or an account number.
We have fewer than fifty employees. The SHIELD Act still applies, with safeguards scaled to our size.
We already follow the Gramm-Leach-Bliley safeguards, HIPAA, or Part 500. The SHIELD Act then treats us as compliant with its safeguards duty.

What it asks of your platform

Part 500, read as a cloud platform

Part 500 asks a covered company for a cybersecurity program based on a risk assessment, with a named person in charge. It then gets specific. Section 500.12 asks for multi-factor authentication for any individual who accesses the company's information systems. Section 500.13 asks for an asset inventory and limits on data retention, and section 500.11 asks for a written policy for third-party service providers.

A 72-hour clock and a yearly certification

A covered company notifies DFS no later than 72 hours after it determines that a cybersecurity incident has occurred. The incident can sit at the company, at an affiliate, or at a third-party service provider. Every year by 15 April, the company also certifies its compliance or acknowledges where it falls short. That clock needs alerting that wakes someone, logs that survive the incident, and a runbook with names in it.

How Part 500 reaches a vendor

A startup that sells to a covered company isn't regulated by Part 500 itself. Its customer is, and section 500.11 makes that customer assess its service providers and set minimum security practices for them. In practice that arrives as contract terms: access controls with multi-factor authentication, encryption, and prompt notice of an incident. A vendor that can show those three closes the deal faster.

The SHIELD Act's reasonable safeguards

Section 899-bb(2) asks any business that holds private information about a New York resident for reasonable safeguards. The statute lists what a compliant program includes. Someone coordinates it, risks are identified and assessed, staff are trained, and service providers are bound by contract. On the technical side it asks for risk assessment in software design, detection of and response to attacks, regular testing, and disposal of data that's no longer needed.

How I help

The engineering behind the guide. Each one starts with a map of the platform as it runs today.

Book a call

Where to start

Cloud Security Posture & Hardening

We map every way into your cloud accounts, rank the gaps by what an attacker reaches first, and close the ones that matter, in code, with your team.

$10,000 to $18,000

See what's included

Platform engineering

I do cloud engineering on the platform you already run. I make it calmer, cheaper, and understood by more than one person on the team.

Cloud security hardening

I find the gaps in your cloud accounts, identity, network, and data, rank them by what an attacker reaches first, and close them with your team.

SOC 2 and security questionnaires

What a SOC 2 report and an enterprise security questionnaire ask of a startup's cloud platform, and what to build before the first big deal.

FTC Safeguards Rule

What the FTC Safeguards Rule (16 CFR Part 314) asks of a non-bank fintech's cloud platform: a written program, encryption, MFA, testing, and vendor oversight.

US state AI laws

What Colorado's SB 26-189 and other state AI laws ask of a team that builds or deploys automated decisions, read as engineering work.

AI-assisted development

My AI engineering workflow for a team: how I set up Claude Code, Codex, and similar agents with instruction files, retrieval, shared memory, and code review.

Securing AI-generated apps

What changes when an agent writes the code: the new attack paths, the controls that close them on AWS, Azure, and Google Cloud, and the evidence buyers ask for.

GitHub best practices (free)

A free guide to GitOps guardrails on GitHub: rulesets, independent reviewers, required pull requests and checks, Conventional Commits, and branch names.

We're not in New York. Does the SHIELD Act apply?: It can. The duty follows the data, not the office: it applies to a business that owns or licenses computerized data with private information about a New York resident. A startup in another state with New York customers is inside it. The attorney general enforces the section, and the statute creates no private right of action.
Are small companies exempt from Part 500?: Part 500 has limited exemptions for smaller covered companies, in section 500.19. They lift some requirements and keep others, and the company files a notice to claim them. I recommend reading the current text with counsel before relying on one. The thresholds changed with the 2023 amendments.
What would you build first?: Multi-factor authentication on every sign-in, because both rules and every vendor contract ask for it. Then an inventory of where private information sits, and logging that can show who touched it. Which of those three would be hardest to show for your platform today?

Let's talk.

A 30-minute call, no pitch. We look at your current setup, your stage, and the thing that's bothering you about it. I give a straight opinion on what to change, what to leave alone, and whether the problem is the one it looks like. What's the one thing in your stack you'd fix tomorrow?

Book a call See pricing

Prefer email or phone? hello@netninjas.us or +1 (347) 486-4242