Most Westchester small businesses answer to some mix of New York’s SHIELD Act, HIPAA, the DFS cybersecurity regulation, the FTC Safeguards Rule, and PCI DSS, and most of those rules ask for the same core controls. Which ones apply to you depends on your industry and the data you hold, not on the county.
SHIELD. HIPAA. Part 500. Safeguards. PCI. Five names, four different enforcers plus the card networks, and an owner can easily conclude that means five separate compliance projects.
It usually doesn’t. I’ll put my view in my own words:
“All of these compliance outlines or frameworks, they’re all kind of based on the same things. So it’s just a matter of which of these plug-and-play components do you need. This industry does things, protects things exactly the same as this industry does, and this is slightly different. It’s all the same things though. So they can call it whatever they want, but it’s all the same kind of practices and technologies.”
That idea sits under all of the cybersecurity work my team does for small businesses in Rockland, Westchester, and Bergen. This post sorts out which rules most likely reach a Westchester business, maps the controls they share, and is honest about where an IT provider’s job ends. If you landed here looking for IT support in Westchester more broadly, that page covers the rest of what we do in the county.
There Is No Separate Westchester Rulebook
As far as I know, Westchester doesn’t add anything special on top of New York State’s requirements. The county name is what people type into a search bar. The rules themselves come from Albany, from Washington, and in one case from the card networks.
Good news, mostly. So what decides your list? Two things. Your industry, and whose information sits on your systems. A six-person dental office in White Plains and a six-person insurance agency in Tarrytown share a county and very little else on this question.
The Five Rules a Westchester Small Business Most Often Meets
Here is who each one reaches, in plain terms. Several can apply to the same business at once. Read every row.
| Rule | Who it reaches | Who enforces it |
|---|---|---|
| NY SHIELD Act (GBL 899-aa and 899-bb) | Any business holding computerized private information about a New York resident | New York Attorney General |
| HIPAA Security Rule | Health plans, clearinghouses, providers that bill electronically (most practices), and the business associates handling their patient data | HHS Office for Civil Rights |
| 23 NYCRR Part 500 | Anyone licensed under New York’s Banking, Insurance, or Financial Services Law, including insurance agents and brokers | NY Department of Financial Services |
| FTC Safeguards Rule (16 CFR 314) | Financial institutions under the FTC’s GLBA jurisdiction, which the FTC says includes tax preparation firms and mortgage brokers | Federal Trade Commission |
| PCI DSS v4.0.1 | Any business that accepts, processes, stores, or transmits payment card data | Card brands and your acquiring bank, by contract rather than statute |
The SHIELD Act reaches nearly everyone
If you hold a New York resident’s Social Security number, driver’s license number, account number with its access code, biometric data, or a username paired with a password, New York’s breach law already applies to you. Who doesn’t hold one of those? Your headquarters address doesn’t change it either. Two amendments matter if you last read about SHIELD before 2025. In December 2024, New York capped breach notice at thirty days after discovery, outside the legitimate needs of law enforcement, and added the Department of Financial Services to the agencies that get notified, though only when the business is a Part 500 covered entity. Then, from March 2025, the definition of private information grew to include medical information and health insurance information, according to the current text of General Business Law 899-aa.
The companion section, 899-bb, requires a reasonable data security program. A small business, meaning fewer than 50 employees, under $3 million in gross annual revenue in each of the last three fiscal years, or under $5 million in year-end total assets, gets safeguards scaled to its size rather than an exemption. A business that already complies with HIPAA, GLBA rules, or Part 500 is treated as compliant with that safeguards section. Our breakdown of what the SHIELD Act requires of a 20-person business goes further.
HIPAA, and the update that still isn’t final
Medical, dental, therapy, and home-care offices that bill insurance electronically are generally covered entities, and most vendors that handle their patient data are business associates with liability of their own. Today’s Security Rule mixes required and “addressable” specifications. HHS proposed an overhaul on January 6, 2025 that would make encryption and multi-factor authentication required, with limited exceptions.
Still a proposal. Not law. The federal regulatory agenda now lists it as a long-term action with final action targeted for July 2027, which is a planning date and not a legal deadline. The current rule remains the one in force. Encrypt anyway. What it asks of the IT side is laid out in what HIPAA actually requires from your IT provider.
23 NYCRR 500 follows the license
Part 500 doesn’t ask what kind of business you think you run. It asks whether you hold a New York authorization. The regulation covers “any person operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law.” A licensed agent or broker operates under the Insurance Law. So yes, it reaches the agency selling the policy, not only the carrier writing it. Brokers included.
Small agencies often qualify for the limited exemption in section 500.19(a), which applies with fewer than 20 employees and independent contractors (counting affiliates), under $7.5 million in gross annual revenue in each of the last three fiscal years, or under $15 million in year-end total assets. Any one is enough. The exemption removes a lot, including the CISO mandate, penetration testing, and the encryption and incident response planning sections.
It doesn’t remove everything. Not even close. The DFS checklist for limited-exempt entities still lists an annual compliance filing by April 15, an annually reviewed risk assessment, annual training that covers social engineering, access reviews, an asset inventory, vendor assessments, incident reporting, and MFA for remote access, third-party apps holding nonpublic information, and privileged accounts. The last phase of the 2023 amendments, including MFA and the asset inventory, took effect on November 1, 2025. Agencies get the full walkthrough in what 23 NYCRR 500 requires of a New York agency.
I’m not a DFS specialist and won’t pretend to be. My take on the DFS rule, as an IT person, is this.
“It’s very standard stuff. It’s all general business stuff. Cybersecurity basics… nothing that we don’t do. We just don’t call it that.”
The FTC Safeguards Rule catches tax preparers
Plenty of businesses don’t think of themselves as financial institutions. The FTC disagrees. Its list is long. Its Safeguards Rule guidance names tax preparation firms, mortgage brokers, collection agencies, and finance companies, among others. The IRS was blunter in August 2026, writing in IR-2026-92 that “federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan.”
The rule asks for a Qualified Individual to run the program, a risk assessment, access controls, encryption, MFA, activity logging, staff training, vendor oversight, and a written incident response plan. Count your clients. A firm holding information on fewer than 5,000 consumers is excused from four pieces, namely the written risk assessment, the testing cadence, the written incident response plan, and the annual report to leadership. Since May 2024, a breach of unencrypted information involving 500 or more consumers also has to be reported to the FTC within 30 days of discovery. A licensed mortgage broker can sit under this rule and Part 500 at the same time.
PCI DSS is a contract, not a law
Take cards and you’ve agreed to PCI DSS through your merchant agreement. Version 4.0.1 has been the only active version since v4.0 retired at the end of 2024, and the requirements that were future-dated took effect on March 31, 2025. Most small merchants validate with a Self-Assessment Questionnaire. Which one depends on how cards reach you. Ask before you guess. A shop that sends every payment to a fully outsourced, PCI-validated checkout fills out a far shorter questionnaire than one that stores card numbers. The PCI Council’s own advice is to confirm your eligibility with whoever receives your questionnaire, usually your acquiring bank or payment processor.
The Overlap Map
This is where the framework names stop mattering. Eight controls, five rulebooks. Put the rules side by side and the same controls keep surfacing. The wording differs. So do the verbs, which matter. Read “calls for” loosely where a rule is risk-based.
| Control | Which rules call for it | Small-business wrinkle |
|---|---|---|
| Access control and MFA | Part 500 and the FTC rule require MFA, with narrow exceptions. PCI DSS expects it for access into the card environment. HIPAA requires unique logins; MFA is in the pending proposal. | Limited-exempt DFS licensees still owe MFA on remote access, cloud apps with nonpublic data, and admin accounts. |
| Encryption | The FTC rule and Part 500 (full covered entities) require it unless infeasible. PCI DSS requires it for card data. Addressable under HIPAA. | SHIELD doesn’t mandate it, but properly encrypted data generally falls outside its breach-notice duty. |
| Risk assessment | All five, in some form. HIPAA calls it a risk analysis. PCI DSS uses targeted risk analyses for specific requirements. | FTC-covered firms under 5,000 consumers don’t need it in writing. DFS still expects an annual review. |
| Vendor oversight | All five. HIPAA does it through business associate agreements. | The Part 500 vendor policy survives the limited exemption. |
| Security awareness training | All five. | DFS wants it at least annually, including social engineering. |
| Incident response plan | Written plan under the FTC rule, PCI DSS, and Part 500. HIPAA requires incident procedures. SHIELD expects you to respond to attacks and sets the 30-day notice clock. | Small FTC firms and limited-exempt DFS licensees are excused from the written plan, not from reporting. |
| Logging and monitoring | HIPAA audit controls, the FTC rule, PCI DSS, and Part 500 for full covered entities. | Limited-exempt DFS licensees are excused from the audit trail and monitoring sections. |
| Backups | HIPAA requires a data backup plan. Part 500 expects protected backups from full covered entities. | SHIELD, the FTC rule, and PCI DSS don’t name backups outright. You still want them. |
See it? Read down the middle column and the point makes itself. Vendor oversight and training show up everywhere. Risk assessment shows up everywhere under different names. The real differences sit in the right-hand column, in who gets excused from what and how much paperwork each regulator wants to see.
That’s why one well-run program, documented once and labeled several ways, usually beats five parallel efforts. If you want a neutral structure to hang it on, the NIST Cybersecurity Framework is voluntary and free, and our guide to running a NIST CSF 2.0 self-assessment shows how a small business can use it without hiring anyone.
How to Find Out Which Rules Are Yours
My advice here is low-tech. Search your location, your industry, and the words “compliance requirements.” Something like “New York dental office compliance requirements” or “Westchester insurance agency compliance requirements.” Scientific? No. But the results show you which regulator names keep coming up for a business like yours, and that’s the list to start from.
Then answer a few questions honestly.
- Do you hold anything about New York residents beyond a name and an email address? Almost everyone does, which puts SHIELD on the list.
- Does anyone at the business hold a license from DFS?
- Patient information, even a little of it, on your systems or a vendor’s?
- Do you prepare tax returns, arrange loans, or offer another financial product to consumers? Ask whether the FTC treats you as a financial institution.
- Take cards in any form. Find out from your processor which questionnaire is yours.
More than one yes is common. That’s fine. The overlap map above is why that’s less work than it sounds.
When to Bring in a Compliance Professional
Knowing which rules apply is one job. Interpreting them for your business, writing the policies, and signing your name to a certification is a different job. Different skill set. Here’s how I’d describe what most small companies do about it.
“There are compliance specific companies. Like most companies that are small, they don’t have a compliance officer, so there’s these companies that basically offer virtual compliance officers or compliance services. If they talk to us, we would put them in contact with one of those.”
That’s a referral, not something VJNetworks sells. It makes sense when a senior officer has to sign a DFS certification, when a regulator or a client sends a letter asking about your program, when you need to decide whether an incident triggers notice, or when nobody inside the company owns compliance at all. A lawyer belongs in some of those conversations too.
What Your IT Provider Does, and What It Doesn’t
Here’s the division of labor I’d want any client to understand before a regulator ever asks. We implement controls. We don’t audit or certify them. That line matters.
On the implementation side, that covers turning on and enforcing MFA, encryption where the rule calls for it, endpoint security, backups, access reviews when people join and leave, keeping an inventory of what’s on the network, and configuring the technical side of your vendors’ access. Helping clients meet their compliance goals is part of our managed IT agreements, and VJNetworks has done this work across the Tri-State area for over 20 years. When something breaks, someone from my team responds within 15 minutes during business hours.
On the other side of the line, there’s no audit, no certification, no legal opinion, and no compliance officer. Nobody at an IT company should be the one telling you that you’re compliant. We can tell you what’s configured and show you the evidence. Whether that satisfies your regulator is a judgment for you and the professionals you bring in.
This is general information, not legal advice. Rules change, and how they apply depends on your licenses, your data, and your contracts.
Questions Westchester Owners Ask About This
Is there a Westchester-specific security rule I’m missing?
We’re a five-person insurance agency. Is the DFS rule really ours?
If our practice is HIPAA compliant, can we forget about SHIELD?
Our tax office has maybe 800 clients. Does the FTC rule even notice us?
Everything goes through a hosted checkout. How much of PCI DSS lands on us?
Can VJNetworks certify that we’re compliant?
Talk with our team about the security controls your compliance rules have in common and what it takes to put them in place. No cost, no obligation.