Why So Much Fuss Over SHIELD?
The last year was a significant year for cybersecurity legislation. It saw over 330 bills and regulations pertaining to cybersecurity introduced in at least 36 states. You may have heard about some of these new rules, such as the California Consumer Privacy Act (CCPA), but the SHIELD act stands out as unique. The SHIELD Act, like CCPA, requires companies to adopt security programs to reduce risks of a data breach. However, SHIELD, unlike CCPA, defines the specific steps a business must take to meet a “reasonable security” standard.
SHIELD is also unique in that it broadens the definition of a “breach” to include not just theft of digital information but also the unauthorized access of such data. E.g., an employee who finds and opens documents on your network without valid authorization. In the event of unauthorized access of data under SHIELD, a consumer notification must be sent, whereas, before SHIELD, a notification would only be triggered if consumer data was acquired by an unauthorized person(s).
How To Be SHIELD Act Compliant
The administrative safeguards prescribed by New York State include naming a CISO, proactive threat monitoring, conducting a risk assessment, delivering security awareness training, and incident response planning. It’s important to have a consultative partner when planning to meet these requirements so that organizations don’t spend more than necessary to achieve compliance.
The tools needed to reach compliance are complex and vary in their feature sets, but working with a trusted partner can help you select tools that maximize the utility of your compliance investment. For instance, Twinstate Technologies can help businesses choose a single threat monitoring solution that satisfies four different safeguards across the technical, physical, and administrative categories.
Ready to Schedule your SHIELD Assessment?
