SHIELD Act Compliance Automation
NY SHIELD Act reasonable security,continuously evidenced.
CISGuard automates the reasonable security expectations of the New York SHIELD Act with continuous CIS benchmark scanning, drift detection, and the audit trail New York Attorney General enforcement looks for.
- Statute
- NY General Business Law Section 899-bb (effective March 2020)
- Enforcement
- New York Attorney General
- Scope
- Any business owning or licensing private information of NY residents
- Technical safeguards itemization
- Section 899-bb(2)(b)(II) lists 8 specific technical-control areas
- Civil penalty
- Up to $5,000 per violation; settlement orders have ranged into millions
- CISGuard evidence
- CIS Benchmark results for the 899-bb(2)(b)(II) technical areas; no built-in SHIELD Act mapping
Overview
What is SHIELD Act?
The New York Stop Hacks and Improve Electronic Data Security Act (SHIELD Act, NY General Business Law Section 899-bb, effective March 2020) imposes reasonable security obligations on any person or business that owns or licenses private information of a NY resident, regardless of where the business is located. The statute explicitly defines reasonable safeguards as administrative, technical, and physical, with the technical safeguards (Section 899-bb(2)(b)(II)) directly itemizing risk assessment, access controls, network and software design, information system management, monitoring, system development controls, training, and incident response. The NY Attorney General has actively enforced the statute since 2020, with public settlement orders against companies with weak SHIELD Act postures. CISGuard's continuous CIS benchmark scanning is a direct fit for the technical-safeguards itemization, with multi-framework mapping to NYDFS, NIST 800-53, and the broader US state-privacy patchwork.
How CISGuard automates SHIELD Act evidence
The NY SHIELD Act explicitly itemizes 8 technical-safeguard areas in Section 899-bb(2)(b)(II), 7 of which are directly automatable through CIS benchmark scanning, drift detection, and audit-trail evidence. The NY Attorney General has actively enforced the statute with public settlement orders that look for continuous-operation evidence rather than point-in-time attestation. CISGuard's continuous evidence base provides exactly that, with the multi-framework mapping to NYDFS, NIST 800-53, and the broader state-privacy patchwork producing portable evidence for any subsequent supervisor or plaintiff-side review.
Control mapping
SHIELD Act technical safeguards (Section 899-bb(2)(b)(II)) CISGuard automates.
Each CIS control is tagged with its framework reference. One scan produces the per-framework coverage report, with satisfied, partially satisfied and not-met status for every control.
| Control area | Controls | Mapped by |
|---|---|---|
| Risk Assessment | Risk assessment of internal and external risks | Per-asset baseline + drift event evidence base |
| Access Controls | Identification, authentication, access rights | CIS Account + Identity benchmarks |
| Network and Software Design | Secure network architecture, software development controls | CIS configuration evidence + drift detection |
| Information System Management | Operations, monitoring, sustainment | Continuous CIS benchmark scanning |
| Monitoring | Continuous monitoring of unauthorized access | Drift detection + SIEM forwarding |
| System Development Controls | SDLC, dev / test / prod segregation | Per-environment scoped evidence |
| Training | Workforce training and awareness | Out-of-scope for CISGuard (organizational layer) |
| Incident Response | Detection, response, recovery | Drift detection + SIEM webhook + audit trail |
Auditor evidence
Evidence artifacts CISGuard generates.
Auditor-grade outputs in PDF, HTML, JSON, CSV and SARIF. No spreadsheets, no screenshots, no manual cross-referencing.
- SHIELD Act Section 899-bb(2)(b)(II) coverage report
- Per-control technical-safeguards evidence with timestamps
- Continuous configuration audit trail
- Drift detection events for monitoring expectation
- Per-asset hardening evidence with timestamps
- Multi-framework cross-walk to NYDFS, NIST 800-53, and broader state-privacy patchwork
Frequently asked
SHIELD Act questions, answered directly.
Does the SHIELD Act apply to out-of-state businesses?
Yes. The SHIELD Act applies to any person or business that owns or licenses private information of a NY resident, regardless of where the business is located. An out-of-state SaaS operator serving NY customers is in scope; a national retailer with NY customers is in scope. CISGuard's continuous evidence base supports out-of-state operators meeting the NY AG's reasonable-security expectation.
How does the SHIELD Act differ from NYDFS 23 NYCRR 500?
NYDFS 23 NYCRR 500 applies to NY-licensed financial entities specifically; SHIELD Act applies to any business handling NY-resident private information. NYDFS is more prescriptive; SHIELD Act is more general but explicitly itemizes the 8 technical-safeguard areas. CISGuard's multi-framework mapping covers both from a single CIS benchmark scan.
What enforcement actions has the NY AG brought under SHIELD Act?
The NY Attorney General has actively enforced SHIELD Act since 2020 with public settlement orders. Notable cases include enforcement against Stop & Shop, Wegmans, EyeMed (vision-care), Herff Jones, and others. Settlements have ranged from hundreds of thousands to millions of dollars, with corrective-action programs that look exactly like the continuous evidence base CISGuard produces.
How does SHIELD Act interact with the NY Department of Financial Services examination process?
For NY-licensed financial entities, NYDFS examines under 23 NYCRR 500 directly. SHIELD Act provides a private cause of action exposure layer that NY AG can pursue independently. CISGuard's continuous evidence base satisfies both directions: NYDFS examiner walking through 23 NYCRR 500 sections, and NY AG enforcing SHIELD Act Section 899-bb(2)(b)(II).
Does CISGuard help with the broader US state-privacy enforcement landscape?
Yes. Beyond NY SHIELD Act, the broader US state-privacy patchwork (California CCPA / CPRA, Massachusetts 201 CMR 17, Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA, Tennessee TIPA) all use reasonable-security expectations operationalized through continuous CIS benchmark coverage. CISGuard supports the entire patchwork from one evidence base.
SHIELD Act readiness, on request.
Our compliance engineers have helped organizations achieve regulatory readiness through a seamless, fully managed deployment.