Skip to content
Invadel

Compliance

NY SHIELD Act
Requirements &
Compliance Testing

The NY SHIELD Act (Stop Hacks and Improve Electronic Data Security Act) is New York’s data security and breach notification law, General Business Law §§ 899-aa and 899-bb, covering any business that holds New York residents’ private information.

Component tests from $4,200, free retest. See all pricing →

Get a fixed quote

Reply the same day

Full scoping questionnaire 
Senior certified testers, manual-first185+ years combined experienceOnboarding within 24 hoursFree retest includedOur methodology

When you need it

When SHIELD Act testing comes up

The situations that bring teams to this engagement, and where it fits alongside the rest of your program.

  • A customer, insurer, or enterprise buyer asked how you meet the SHIELD Act’s reasonable safeguards requirement, and you have policies but no test results.
  • You hold New Yorkers’ Social Security, driver’s license, or account numbers, or since March 21, 2025 their medical or health insurance information, and nobody has tested the systems that store it.
  • You are based outside New York but sell to, employ, or collect data on New York residents, so the Act applies to you anyway.
  • Counsel is preparing for the 30-day notice clock and wants to know whether your logs could show what an intruder accessed.
  • A peer in your industry settled with the Attorney General, and leadership wants to know whether the same weakness sits in your quoting tool, portal, or mailbox.

Who it covers

Who the NY SHIELD Act applies to

The New York SHIELD Act applies to any person or business that owns or licenses computerized data including the private information of a New York resident (GBL 899-bb(2)(a)). Where the business is based does not matter, and neither does whether it sells in New York. In March 2025 the Attorney General secured $975,000 from an auto insurer that does not offer insurance in New York, after its online quoting tool exposed about 45,000 New Yorkers’ driver’s license numbers.

You own or license the data

You must develop, implement, and maintain reasonable safeguards for its security, confidentiality, and integrity, including its disposal (899-bb(2)(a)), and notify affected residents after a breach (899-aa(2)). Customer, patient, and employee records all count.

You maintain it for someone else

Payroll providers, managed IT providers, and hosting and SaaS vendors must notify the owner or licensee immediately after a breach, and no later than 30 days after discovery (899-aa(3)). A client’s program counts as compliant when it selects providers capable of appropriate safeguards and requires them by contract (899-bb(2)(b)(ii)(A)(5)), so expect the questionnaire.

You are a small business

Still covered, under a scaled standard; see the small business rule below.

You are already regulated

Deemed compliant with 899-bb while in compliance with GLBA, HIPAA, or Part 500; see below.

Not sure where to start? An external network penetration test of everything internet-facing and a validated vulnerability assessment of the network are the usual first two, both at the fixed prices on our pricing page. Every framework we report against is on our compliance testing page.

Private information

What counts as private information

Personal information is any information that can identify a natural person (899-aa(1)(a)). It becomes private information when combined with one of the data elements below, and either the element or the combination is unencrypted, or encrypted with a key that was also accessed or acquired (899-aa(1)(b)(i)). Online account credentials count on their own (899-aa(1)(b)(ii)). Information lawfully made available to the public from government records is excluded.

What it covers

Social Security number
Combined with a name or other identifier
Driver’s license or non-driver ID number
Combined with a name or other identifier
Account, credit, or debit card number with its code
Together with a security code, access code, password, or other information that permits access to the financial account
Account, credit, or debit card number alone
Where the number could be used to access the account without any additional identifying information, code, or password
Biometric information
Data from electronic measurement of unique physical characteristics, such as a fingerprint, voice print, or retina or iris image, used to authenticate or identify a person
User name or email address with a password or security question and answer
Anything that would permit access to an online account, with or without a name attached
Medical information
Medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional
Health insurance information
A policy or subscriber ID number, any unique identifier a health insurer uses, and information in the application and claims history, including appeals

Covered since

Social Security number
The original 2005 law
Driver’s license or non-driver ID number
The original 2005 law
Account, credit, or debit card number with its code
The original 2005 law
Account, credit, or debit card number alone
October 23, 2019 (SHIELD Act)
Biometric information
October 23, 2019 (SHIELD Act)
User name or email address with a password or security question and answer
October 23, 2019 (SHIELD Act)
Medical information
March 21, 2025
Health insurance information
March 21, 2025

The safeguards duty in 899-bb borrows this definition (899-bb(1)(b)), so the 2025 additions widened what must be protected as well as what must be reported. An employer holding health plan records, a wellness app, or a law firm with medical records in a case file now holds private information whether or not HIPAA reaches it. For every row except online credentials, encrypted data is not private information unless the key was also accessed or acquired (899-aa(1)(b)(i)); credentials under (1)(b)(ii) have no encryption exception. That is why our testing checks where Social Security and account numbers sit unencrypted, and whether the keys sit beside them.

Section 899-bb

NY SHIELD Act requirements: the reasonable safeguards

Section 899-bb(2)(a) requires reasonable safeguards. Paragraph (2)(b)(ii) then describes a data security program that counts as compliant: six administrative, four technical, and four physical safeguards. It names no tool, method, or frequency, so reasonableness is judged against your size, your data, and your risks. A published benchmark such as the CIS Controls is a useful yardstick, though the statute names none. One technical safeguard is testing by name: a program that “regularly tests and monitors the effectiveness of key controls, systems and procedures.”

What the program does

(A)(1) Administrative
Designates one or more employees to coordinate the security program
(A)(2) Administrative
Identifies reasonably foreseeable internal and external risks
(A)(3) Administrative
Assesses whether the safeguards in place control the identified risks
(A)(4) Administrative
Trains and manages employees in the program’s practices and procedures
(A)(5) Administrative
Selects service providers capable of appropriate safeguards and requires those safeguards by contract
(A)(6) Administrative
Adjusts the program for business changes or new circumstances
(B)(1) Technical
Assesses risks in network and software design
(B)(2) Technical
Assesses risks in information processing, transmission, and storage
(B)(3) Technical
Detects, prevents, and responds to attacks or system failures
(B)(4) Technical
Regularly tests and monitors the effectiveness of key controls, systems, and procedures
(C)(1) Physical
Assesses risks of information storage and disposal
(C)(2) Physical
Detects, prevents, and responds to intrusions
(C)(3) Physical
Protects private information against unauthorized access or use during or after its collection, transportation, and destruction or disposal
(C)(4) Physical
Disposes of private information within a reasonable time after it is no longer needed, by erasing electronic media so it cannot be read or reconstructed

Testing evidence we supply

(A)(1) Administrative
The designation is your policy; we give that coordinator an executive summary with the decision each finding needs
(A)(2) Administrative
Real attack paths found by testing, input to your security risk assessment
(A)(3) Administrative
A test of each key control against a real attempt, with the result recorded
(A)(4) Administrative
Phishing simulation results by department, including how fast staff reported
(A)(5) Administrative
Testing of vendor remote access and shared accounts, and an attestation letter you can give your own customers
(A)(6) Administrative
A new test scoped to the change after a new system, an acquisition, or an office move
(B)(1) Technical
External and internal network tests, and web application testing
(B)(2) Technical
Where private information sits unencrypted, travels in clear text, or is returned unmasked
(B)(3) Technical
Whether your logs and alerts caught our activity, with timestamps to check
(B)(4) Technical
A dated penetration test, validated vulnerability assessments between tests, and a free retest
(C)(1) Physical
Old exports, backups, and file shares holding private information that should have been disposed of
(C)(2) Physical
Physical penetration testing of the office: tailgating, badges, and unattended network ports
(C)(3) Physical
Private information found in transit or in staging areas: clear-text file transfers, exposed exports, and devices left reachable
(C)(4) Physical
Retired systems and stale data still reachable, found and reported so they can be disposed of

References are to 899-bb(2)(b)(ii). The list describes a compliant program; it is not a list of required tools, and it sets no testing interval, so “regularly” is for you and counsel to define. An annual penetration test with scans in between is the cadence New York’s Department of Financial Services (DFS) sets in 23 NYCRR 500.5 and the FTC sets in 16 CFR 314.4(d)(2) for firms without continuous monitoring, and it is a sensible starting point for everyone else.

What we assess

What your SHIELD Act testing covers

Section 899-bb asks whether your safeguards protect the security, confidentiality, and integrity of private information. We test the systems that hold it, and the logins and people that reach it, along the routes the Attorney General’s own cases show attackers used.

Perimeter & Remote Access

Everything internet-facing that leads to private information: VPN, remote desktop, email, file transfer, and cloud storage.

We test for

  • Internet-facing host and service discovery
  • VPN and remote access authentication
  • MFA coverage and bypass
  • Exposed storage and forgotten backups

Web Apps, Portals & APIs

Quoting tools, customer portals, and APIs that return private information, the way in for several recent Attorney General settlements.

We test for

  • Records returned without proper authentication
  • Unmasked driver’s license and account numbers
  • Credential stuffing and bot controls
  • Authorization between customers and roles

Internal Network & Identity

How far one phished laptop reaches toward the shares, databases, and backups that hold private information.

We test for

  • Active Directory attack paths
  • Unencrypted Social Security numbers on shares
  • Dormant and former-employee accounts
  • Segmentation around private information

Email, People & Detection

The mailbox compromises behind several of the Attorney General’s cases, and whether your logs could show what an intruder viewed.

We test for

  • Phishing and credential capture
  • Mailbox rules and forwarding
  • Logging of access to private information
  • Alerts on suspicious activity

Attorney General guidance

What the Attorney General’s guidance adds

In April 2023 the Attorney General published Protecting consumers’ personal information, nine recommendations drawn from the office’s breach investigations. The guide says it is not a statement of law, but it shows what investigators look for first, and every recommendation is something a test can check.

The case behind it

1. Secure authentication
EyeMed: a corporate mailbox without MFA held six years of customer emails and attachments
2. Encrypt sensitive information
CafePress: Social Security and tax ID numbers for more than 180,000 seller accounts stored in plain text
3. Oversee service providers
T-Mobile: customer information taken from a vendor’s network
4. Know where consumer information is kept
Wegmans: old database backups in a publicly accessible cloud container that security staff did not know existed
5. Prevent data leakage in web applications
Sensitive data shown without authentication, or unmasked where the last four digits would do
6. Protect accounts after an incident
Zoetop (SHEIN): stolen login credentials for tens of millions of accounts, most never reset
7. Delete or disable unnecessary accounts
A school vendor breached through a former employee’s unchanged access key
8. Guard against automated attacks
Dunkin’: the office alleged tens of thousands of customer accounts were compromised in online attacks
9. Give clear and accurate notice
Zoetop: public statements that understated what was taken

How testing checks it

1. Secure authentication
MFA coverage on email, remote access, and admin accounts, and password spraying within agreed rules
2. Encrypt sensitive information
Searching shares, databases, and backups for private information stored unencrypted
3. Oversee service providers
Testing the vendor access paths and accounts that reach your environment
4. Know where consumer information is kept
External discovery of exposed storage and forgotten systems, the testing the guide says an asset inventory would have made possible
5. Prevent data leakage in web applications
Web application and API testing of what each page and endpoint returns
6. Protect accounts after an incident
A detection timeline your team can rehearse its reset-and-notify steps against
7. Delete or disable unnecessary accounts
Dormant, orphaned, and former-employee accounts found and tested
8. Guard against automated attacks
Rate limiting, bot controls, and lockout on login and quoting flows
9. Give clear and accurate notice
Logs that show what an intruder touched, so the notice can be accurate

The guide also points to the office’s January 2022 business guide on credential stuffing. The Attorney General’s SHIELD Act page summarizes the safeguards and links the breach reporting portal.

Small businesses

The small business rule: scaled, not exempt

A small business under 899-bb(1)(c) is one with fewer than 50 employees, less than $3 million in gross annual revenue in each of the last three fiscal years, or less than $5 million in year-end total assets. Meeting any one test is enough, so a 40-person firm with $20 million in revenue qualifies.

Qualifying changes the standard, not the duty. Under 899-bb(2)(c), a small business complies when its program has reasonable administrative, technical, and physical safeguards appropriate for its size and complexity, the nature and scope of its activities, and the sensitivity of the personal information it collects. The breach notification rules in 899-aa apply in full whatever the size of the business.

Professional practices are on the Attorney General’s docket too. In October 2025 the office settled with Wojeski & Company, an accounting firm, for $60,000 after two incidents. Clients’ Social Security numbers were unencrypted in parts of its network, and customers were not told until November 2024, about a year and a half after the first incident. The settlement requires encryption, a data inventory, limits on employee access, a program to find and fix network vulnerabilities, and staff training. For legal practices, our law firm penetration testing guide covers what client data rules add.

  • MFA on email, remote access, and every administrator account.
  • An external test of everything internet-facing, at least once a year.
  • A validated vulnerability assessment of the office network and laptops between tests.
  • Social Security, account, and health insurance numbers encrypted at rest, with the keys kept elsewhere.
  • Accounts removed the day an employee or vendor leaves.
  • A written record of where private information lives, so a breach can be scoped inside 30 days.

Our page on penetration testing for small businesses shows how a first test is scoped, and the small business cyber attack statistics show why attackers do not skip small firms. Professional practices can start from accounting firms or law firms.

Already regulated

GLBA, HIPAA, and NYDFS: when another regime counts

Section 899-bb treats a compliant regulated entity as meeting its safeguards duty (899-bb(2)(b)(i)). The definition in 899-bb(1)(a) covers a business that is subject to, and in compliance with, one of four sets of data security rules. The words that matter are “and in compliance with”: being regulated is not enough, the other program has to hold up.

Safeguards duty

(i) Regulations under Title V of the Gramm-Leach-Bliley Act, such as the FTC Safeguards Rule
Deemed met while in compliance
(ii) HIPAA and HITECH regulations
Deemed met while in compliance
(iii) 23 NYCRR 500, the DFS cybersecurity regulation
Deemed met while in compliance
(iv) Other data security rules of a federal or New York State department, division, commission, or agency
Deemed met while in compliance, as that body or the courts interpret the rules

Breach notice under 899-aa

(i) Regulations under Title V of the Gramm-Leach-Bliley Act, such as the FTC Safeguards Rule
Where your GLBA rules themselves require customer notice (for banks, the federal banking agencies’ response-program guidance), that notice satisfies 899-aa for individuals. The FTC Safeguards Rule requires notice to the FTC only (16 CFR 314.4(j)), so FTC-regulated firms still notify New York residents within 30 days under 899-aa(2). Either way the Attorney General, Department of State, and State Police are notified, and the consumer reporting agencies when more than 5,000 residents are notified (899-aa(2)(b))
(ii) HIPAA and HITECH regulations
HIPAA notice to individuals is enough; the state agencies (and the consumer reporting agencies above 5,000 residents) are still notified (899-aa(2)(b)), and the Attorney General within five business days of any notice to HHS (899-aa(9))
(iii) 23 NYCRR 500, the DFS cybersecurity regulation
Part 500 requires notice to DFS within 72 hours (500.17(a)), not to individuals, so residents are still notified within 30 days under 899-aa(2). The Attorney General, Department of State, State Police, and DFS (in the manner 500.17 requires) are notified, and the consumer reporting agencies when more than 5,000 residents are notified (899-aa(8))
(iv) Other data security rules of a federal or New York State department, division, commission, or agency
Individual notice under the rule counts only if the rule requires it; the agency and consumer reporting agency notices apply either way (899-aa(2)(b))

Testing it asks for

(i) Regulations under Title V of the Gramm-Leach-Bliley Act, such as the FTC Safeguards Rule
Annual penetration testing and vulnerability assessments every six months under 16 CFR 314.4(d)(2), unless continuous monitoring is in place (firms holding information on fewer than 5,000 consumers are exempt under 314.6); see FTC Safeguards Rule testing
(ii) HIPAA and HITECH regulations
Not required by name in the current Security Rule (HHS proposed annual penetration testing in January 2025; the rule is not final), but it is direct evidence for the risk analysis and evaluation the rule requires; see HIPAA penetration testing
(iii) 23 NYCRR 500, the DFS cybersecurity regulation
Annual penetration testing from inside and outside the information systems’ boundaries under 500.5 (small covered entities under 500.19(a) are exempt); see NYDFS penetration testing
(iv) Other data security rules of a federal or New York State department, division, commission, or agency
Depends on the rule; New York general hospitals, for example, test annually under 10 NYCRR 405.46

Ask counsel whether you qualify before relying on the deeming provision. For banks, lenders, and other financial institutions, our GLBA compliance checklist walks through the Safeguards Rule, and the NYDFS 23 NYCRR 500 guide covers Part 500 section by section. One test can be scoped and reported for the SHIELD Act and the sector rule together.

Section 899-aa

Breach notification: the 30-day rule and who to tell

A breach of the security of the system is unauthorized access to or acquisition of computerized data that compromises the security, confidentiality, or integrity of private information (899-aa(1)(c)). Access alone is enough: the statute lets a business weigh indications that information was viewed, communicated with, used, or altered by someone without authorization. Good-faith access by an employee or agent for the business’s purposes is not a breach, provided the information is not used or disclosed without authorization. State agencies follow a parallel rule in State Technology Law 208, which also requires local governments to adopt a notification policy. Since December 21, 2024 (Chapter 647 of 2024), notice has a hard deadline.

The notice must give your contact information, the telephone numbers and websites of the state and federal agencies that help with breach response and identity theft, and the categories of information accessed or acquired, naming which elements (899-aa(7)). It goes out in writing, electronically where the resident has consented, or by telephone. Substitute notice by email, website posting, and statewide media is allowed only if you demonstrate to the Attorney General that direct notice would cost more than $250,000, would reach more than 500,000 people, or that you lack sufficient contact information (899-aa(5)(d)).

One exception: no notice is required if the exposure was an inadvertent disclosure by people authorized to access the information and you reasonably determine it will not likely lead to misuse or financial harm, or, for an unknown disclosure of online credentials, emotional harm. The determination must be written down and kept for five years, and sent to the Attorney General within ten days if more than 500 New York residents are affected (899-aa(2)(a)).

When and what

Affected New York residents
In the most expedient time possible and without unreasonable delay, and no later than 30 days after discovery. Only the legitimate needs of law enforcement can delay it; the old allowance for time to determine the scope and restore the system was removed in 2024.
The owner or licensee, if you only maintain the data
Immediately, and no later than 30 days after discovery
Attorney General, Department of State, Division of State Police
Whenever any New York resident is notified: the timing, content, and distribution of the notices, the approximate number affected, and a copy of the notice template, without delaying notice to residents. One form on the Attorney General’s breach reporting portal reaches all three.
Department of Financial Services
Only if you are a covered entity under 23 NYCRR 500.1, made the way 500.17 requires (Chapter 91 of 2025)
Consumer reporting agencies
When more than 5,000 New York residents are notified at one time
Attorney General, for HIPAA covered entities
Within five business days of notifying HHS of a breach, even one involving information that is not private information under the statute

Section

Affected New York residents
899-aa(2) and (4)
The owner or licensee, if you only maintain the data
899-aa(3)
Attorney General, Department of State, Division of State Police
899-aa(8)(a)
Department of Financial Services
899-aa(8)(a)
Consumer reporting agencies
899-aa(8)(b)
Attorney General, for HIPAA covered entities
899-aa(9)

The 30-day clock is why logging matters. If your logs cannot show what an intruder viewed, it is hard to rule any record out, and the notice grows to match. After each test we give your team a timeline of what we did, from which account, and when, so you can check whether your logs would have scoped a real incident. To rehearse the whole response, from foothold to recovery, see our ransomware readiness assessment.

Timeline

NY SHIELD Act timeline, 2019 to 2026

The Act has been amended several times since it was signed. Guides written before 2025 miss the 30-day deadline, the DFS notice, and the health data additions.

Change

July 25, 2019
SHIELD Act signed
October 23, 2019
Breach notification widened: access as well as acquisition, new data elements (biometrics, online credentials, account numbers usable alone), and coverage of any business holding New Yorkers’ data, wherever it does business
March 21, 2020
The reasonable safeguards requirement in 899-bb takes effect
December 21, 2024
Notice to residents due within 30 days of discovery, vendor notice to owners within 30 days, DFS added to the agencies notified, and the scope-and-restore allowance removed
February 14, 2025
DFS notice limited to Part 500 covered entities and made under 500.17, effective as of the 2024 change
March 21, 2025
Medical information and health insurance information added to private information
February 17, 2026
GBL 349, through which 899-bb is enforced, now covers unfair and abusive practices as well as deceptive ones

Source

July 25, 2019
Chapter 117 of 2019
October 23, 2019
Chapter 117 of 2019, in force 90 days after signing
March 21, 2020
Chapter 117 of 2019, in force 240 days after signing
December 21, 2024
Chapter 647 of 2024, effective immediately
February 14, 2025
Chapter 91 of 2025
March 21, 2025
Chapter 613 of 2024, as amended by Chapter 30 of 2025
February 17, 2026
FAIR Business Practices Act (Chapter 708 of 2025), signed December 19, 2025

Statute text: GBL 899-aa and GBL 899-bb on the New York State Senate’s site. Checked November 2026; confirm the current text with counsel before relying on it.

Enforcement

SHIELD Act penalties, and how the Attorney General enforces them

The Attorney General enforces both sections (899-aa and 899-bb), and 899-bb says expressly that it creates no private right of action (899-bb(2)(e)). The statutory remedies come first below, then recent Attorney General data security settlements (the releases cite reasonable safeguards, not the statute by section). Two of the three involve auto insurers; see penetration testing for insurers.

What the Attorney General can seek

Reasonable safeguards
A failure is deemed a violation of GBL 349, New York’s consumer protection statute. The Attorney General can sue to enjoin it and for civil penalties under GBL 350-d of up to $5,000 per violation.
Breach notification
An injunction, damages for actual costs or losses to people who were not notified, including consequential financial losses, and for knowing or reckless violations a civil penalty of the greater of $5,000 or up to $20 per failed notification, capped at $250,000
Time limit for notification cases
Three years from the earlier of the date the Attorney General learned of the violation or received the agency notice, and never more than six years after the breach was discovered unless the business concealed it

Section

Reasonable safeguards
899-bb(2)(d)
Breach notification
899-aa(6)
Time limit for notification cases
899-aa(6)
  • March 2025: $975,000 from Root, an auto insurer that does not offer insurance in New York, after its quoting tool exposed about 45,000 New Yorkers’ driver’s license numbers in plain text. The office found inadequate risk assessments of public-facing web applications and weak controls against automated attacks.
  • October 2025: $14.2 million from eight car insurers, in an investigation with DFS, over quoting tools that exposed the data of more than 825,000 New Yorkers. The settlements require data inventories, reasonable authentication, and logging and monitoring with alerts.
  • September 2026: about $2.3 million from Labcorp across 44 attorneys general, including $89,178 to New York, over a 2018-2019 breach at its debt collector that predates the SHIELD Act, with new vendor risk management requirements.

Settlements also require security programs, inventories, and monitoring on top of the payment. Our guide to data breach fines and penalties sets the SHIELD Act beside NYDFS, HIPAA, and GDPR. This page is not legal advice; counsel should assess your exposure.

Tester, not certifier

We test. Counsel advises. Nobody certifies.

There is no SHIELD Act certification, and no auditor or regulator issues one. Whether your safeguards are reasonable is a legal judgment, made by counsel in advance and by the Attorney General or a court after a breach. What we supply is the evidence that judgment rests on.

Your counsel

Decides whether you are covered, whether the compliant regulated entity provision applies, whether an incident is a breach that must be notified, and what “regularly” and “reasonable” mean for your business.

Invadel, the tester

Tests the key controls, reports what held and what did not with evidence and fix guidance, and retests. The report and attestation letter show your safeguards were tested.

Your team

The employee who coordinates the security program fixes what testing finds, records why any remaining risk is accepted, and schedules the next test when the business changes.

  • A penetration test report dated within the last year, with a scope statement naming the systems that hold private information.
  • Findings rated by severity and mapped to the 899-bb safeguards they touch.
  • Retest results showing remediated findings closed.
  • Vulnerability assessment records between tests, validated by an analyst rather than exported raw.
  • Phishing results for staff with access to private information.
  • A detection timeline showing what your logs and alerts recorded.

We do not issue SHIELD Act certifications, audits, or legal opinions, and a certificate from any vendor carries no weight under the statute. Hospitals and DFS-regulated firms will find the same evidence model on our New York hospital cybersecurity regulations and NYDFS penetration testing pages.

Methodology

How we test

Full methodology →

Every engagement follows the Penetration Testing Execution Standard and the relevant OWASP guides.

These are the phases your compliance test runs through.

  1. 01

    Scope to the data

    The systems that hold New Yorkers’ private information, and the routes that lead to them.

  2. 02

    Test the key controls

    External, internal, application, and email testing against the technical safeguards 899-bb lists.

  3. 03

    Map to the safeguards

    Every finding tied to the administrative, technical, or physical safeguard it evidences.

  4. 04

    Report for counsel

    A dated report and an executive summary for your security coordinator and for counsel.

  5. 05

    Fix & retest

    A free retest so the record shows remediated findings closed.

How it works

How your engagement runs

From scope through the final retest, your team stays in the loop at every step, with findings tracked live in our platform.

  1. 01

    Scope to the private information

    You tell us where New Yorkers’ private information lives (applications, file shares, mailboxes, cloud storage, and vendor connections), and we scope the tests to those systems and the routes to them.

  2. 02

    Test the key controls

    External, internal, application, and email testing against the technical safeguards 899-bb lists, dated for your records.

  3. 03

    Report to the safeguards

    Findings mapped to the administrative, technical, and physical safeguards, with a summary your security coordinator and counsel can use.

  4. 04

    Fix & retest

    Close the findings, then a free retest so the record shows the controls working.

Fixed prices

What SHIELD Act testing costs

Published starting prices, fixed in writing before work begins. For a small office, start with the first two; add the rest where private information sits on an internal network, behind a portal, or in mailboxes. Our Google Workspace security checklist lists the tenant settings to fix before a review.

Safeguards it evidences

External penetration test
(B)(1) and (B)(4): the internet-facing edge, VPN, email, and exposed storage
Vulnerability assessment
(B)(4): monitoring between tests, validated by an analyst
Internal penetration test
(B)(1) to (B)(3): paths to private information, encryption at rest, and detection
Web application penetration test
(B)(2): portals and quoting tools that return private information
Microsoft 365 or Google Workspace review
(B)(3) and the Attorney General’s authentication guidance: MFA, mailbox rules, and sharing
Phishing simulation
(A)(4): training measured by results
Physical penetration test
(C)(2): one NYC-metro office, two operators on site

Price

Vulnerability assessment
$1,500 up to 250 devices, $2,500 up to 1,000, free re-scan
Internal penetration test
From $6,000, free retest
Web application penetration test
From $5,200, free retest
Physical penetration test
From $6,800, free retest

Every starting price is on our pricing page, and the price calculator adds up several tests. Larger estates are quoted from the scope as one fixed price. Send the scoping questionnaire and you get a written fixed price the same day, no sales call. Testing runs remotely nationwide and on site from our Manhattan office; see penetration testing in New York City or SHIELD Act testing for Westchester businesses.

Component tests

The tests behind your SHIELD Act evidence

Compliance testing is built from our standard fixed-scope engagements. Each one is scoped to your boundary and reported against the framework.

External penetration testEverything internet-facing that leads to private information, the key-control test in 899-bb(2)(b)(ii)(B)(4). From $4,200.Vulnerability assessmentAnalyst-validated scans between tests, part of the monitoring evidence for the same safeguard. From $1,500.Internal penetration testHow far one compromised workstation reaches toward private information. From $6,000.Web application penetration testPortals, quoting tools, and logins that return private information. From $5,200.Microsoft 365 security assessmentMFA, mailbox rules, and sharing in the email tenant, the first item in the Attorney General’s guidance. From $4,200.Phishing simulationEmployee training measured by results, for the (A)(4) safeguard. From $3,600.

Proof

Proof in the field

Every engagement is confidential, so the work below is anonymized to sector and engagement type.

All case studies →

Free

Retest on every penetration test

185+

Years combined experience

14

Senior in-house specialists

24h

Onboarding after signing

HR & Payroll SaaS

Web Application Penetration Test

High risk

Critical: a file-inclusion flaw that let an attacker read sensitive files from the server through the application itself. High: stored cross-site scripting capable of session theft, insecure direct object references, and an authorization bypass that let an administrator create or delete organization owners.

Outcome. Delivered a remediation plan sequenced by real business impact, critical and high findings first, with a complimentary retest to verify every fix.

28

Findings

1

Critical

5

High

Read the case study

Fintech · Payments

Post-Incident Web App Assessment

Medium risk

Excessive data exposure: API responses leaked transaction metadata, including precise geolocation, enabling real-world tracking of users.

Outcome. Surfaced the exposure and hardening gaps, prioritized by how readily an attacker could chain them, and delivered fix guidance plus a retest to confirm closure.

8

Findings

3

Medium

Post-incident

Engagement

Read the case study

In their words

What clients say

From the technical and business leaders who hired us, about the work and the report they got.

See who we test for 

We reached out to Invadel after our infrastructure provider was breached and we needed to ensure our new footprint was as secure as possible. Invadel was able to jump in and quickly get things moving. They found some open attack surfaces that we patched immediately. Our VAPT report was extremely helpful and the deliverables were perfect. I’ve worked with many security agencies in my time and Invadel tops the list.

Dylan Stamat, CTO at Booster SEO

Dylan Stamat

CTO, Booster SEO

SEO and marketing software

Booster SEO
LatentPerygeeOverAIAubaDesteiaLegacy
Request a reference 

Resources

Field notes from the offensive side

All articles →

Data Breach Fines and Penalties by Law: NYDFS, HIPAA, PCI DSS, GDPR, SEC and New York SHIELD

Data breach fines and penalties under NYDFS Part 500, HIPAA, PCI DSS, GDPR, the SEC rule and New York's SHIELD Act, with the enforcement actions behind them.

NYDFS Cybersecurity Regulation (23 NYCRR 500): Complete Guide

The NYDFS cybersecurity regulation (23 NYCRR 500) section by section: who it covers, Class A rules, the 500.5 testing mandate, and the April 15 certification.

Small Business Cyber Attack Statistics 2026: How Often, How Much, and Why

Sourced 2026 statistics on cyber attacks against small businesses: attack rates, ransomware share, breach costs, insurance claims, and what changed this year.

Want to see a report first?

Read a sample report for a fictional client, or request a redacted one from a real engagement. Our guide explains what a penetration testing report should contain.

See the sample report

FAQ

Frequently asked questions

What teams most often ask before NY SHIELD Act testing.

Still have questions? 
01Who does the NY SHIELD Act apply to?

Any person or business that owns or licenses computerized data including the private information of a New York resident (GBL 899-bb(2)(a)), wherever the business is located and whether or not it sells in New York. An online store in Florida whose New York customers log in with an email and password, or a California employer with remote staff in New York, is covered. The breach notification rules in 899-aa reach the same businesses, plus any business that maintains such data for someone else, which must tell the owner within 30 days of discovering a breach.

02What does the NY SHIELD Act require?

Two things. Section 899-bb requires reasonable administrative, technical, and physical safeguards for New York residents’ private information, including its secure disposal, and lists the elements of a program that counts as compliant. Section 899-aa requires notice after a breach: to affected residents within 30 days of discovery, to the Attorney General, the Department of State, and the State Police whenever residents are notified, and to others in some cases. The Attorney General enforces both.

03Does the SHIELD Act require penetration testing?

Not by name. Among the technical safeguards in 899-bb(2)(b)(ii)(B), a compliant program “regularly tests and monitors the effectiveness of key controls, systems and procedures.” The statute sets no method or interval. A penetration test with the fixes retested is the most direct evidence that key controls work, and validated vulnerability assessments between tests help evidence the monitoring. New York’s Department of Financial Services requires annual penetration testing of covered entities other than small ones exempt under 500.19(a) (23 NYCRR 500.5(a)(1)), and the FTC requires it of financial institutions holding information on 5,000 or more consumers unless they run effective continuous monitoring (16 CFR 314.4(d)(2) and 314.6), which makes once a year a defensible floor. Counsel decides what is reasonable for your business.

04Does the SHIELD Act apply to small businesses?

Yes, with a scaled standard. A business with fewer than 50 employees, under $3 million in gross annual revenue in each of the last three fiscal years, or under $5 million in year-end total assets needs safeguards appropriate for its size, activities, and the sensitivity of its data (899-bb(1)(c) and (2)(c)), and breach notification applies in full.

05How long do we have to notify after a breach in New York?

Thirty days. Since December 21, 2024, 899-aa(2) requires notice to affected residents in the most expedient time possible and without unreasonable delay, and no later than 30 days after the breach is discovered. Only the legitimate needs of law enforcement can push it later; the former allowance for time to determine the scope of the breach and restore the system was removed. If you maintain the data for another business, you must tell that business immediately, and within 30 days (899-aa(3)).

06What are the penalties for violating the SHIELD Act?

For the safeguards duty, a failure is deemed a violation of GBL 349, and the Attorney General can seek an injunction and civil penalties of up to $5,000 per violation under GBL 350-d (899-bb(2)(d)). For notification failures, a court can award damages for losses to people who were not notified and, for knowing or reckless violations, a penalty of the greater of $5,000 or up to $20 per failed notification, capped at $250,000 (899-aa(6)). Section 899-bb creates no private right of action. Recent Attorney General settlements run from $60,000 for an accounting firm to $14.2 million across eight auto insurers, each with required security programs on top. Our guide to data breach fines and penalties compares them with other laws.

07We follow HIPAA, GLBA, or NYDFS rules. Does that cover the SHIELD Act?

For the safeguards duty, possibly. A business subject to, and in compliance with, the GLBA, HIPAA, or 23 NYCRR 500 data security rules is a compliant regulated entity and is deemed to meet 899-bb (899-bb(1)(a) and (2)(b)(i)), so the testing those rules expect doubles as your SHIELD Act evidence. Breach notice still applies in part. Where your regime itself requires notice to individuals, as HIPAA does, that notice covers them, but the Attorney General, the Department of State, and the State Police must still be told, and the consumer reporting agencies when more than 5,000 residents are notified (899-aa(2)(b)). Part 500 and the FTC Safeguards Rule require notice only to the regulator, so firms under those rules still notify New York residents within 30 days. Counsel should confirm you qualify.

08Can Invadel certify that we comply with the SHIELD Act?

No. There is no SHIELD Act certification or audit, and the statute recognizes none. Whether your safeguards are reasonable is a legal judgment for counsel, and after a breach for the Attorney General or a court. We supply the evidence that judgment rests on: a dated report of which key controls held, an attestation letter, and a free retest showing the fixes worked.

09Is the SHIELD Act the same as New York’s shield law?

No. The SHIELD Act, short for Stop Hacks and Improve Electronic Data Security, is the data security and breach notification law in GBL 899-aa and 899-bb, signed in 2019. New York’s separate shield law protects patients and providers of reproductive and gender-affirming health care from out-of-state legal action. They share a name in search results and nothing else.

10How much does SHIELD Act testing cost?

Each component test has a published starting price, fixed in writing before work begins: an external penetration test from $4,200 and a validated vulnerability assessment at $1,500 for up to 250 devices, with internal testing from $6,000 and web application testing from $5,200 where private information sits on an internal network or behind a portal. Penetration tests include a free retest. Every starting price is on our pricing page, and the scoping questionnaire gets you a written fixed price the same day.

11Is there a NY SHIELD Act compliance checklist?

The statute supplies its own. Section 899-bb(2)(b)(ii) lists six administrative, four technical, and four physical safeguards that make up a compliant program, and the safeguards table on this page sets each one beside the testing evidence for it. There is no official form to complete and nothing to file with the state. For a small office, the six-point list in the small business section above is a practical place to start.

12Does the SHIELD Act require a written information security program?

Not in those words. Section 899-bb(2)(b)(ii) describes a business that “implements a data security program” with the listed safeguards, and it does not say the program must be in writing. Several of those safeguards are hard to show without documents, though: a designated coordinator, identified risks, staff training, and vendor contracts that require safeguards. A written program with dated test reports attached is the practical way to prove yours after a breach, and counsel can advise on its form.

13Does the NY SHIELD Act apply to nonprofits?

The statute does not carve them out. Section 899-bb(2)(a) applies to “any person or business” that owns or licenses computerized data including New York residents’ private information, and it neither defines that phrase nor mentions nonprofits. A nonprofit holding donor, client, or employee records with those data elements should assume it is covered and ask counsel to confirm. If it meets the small business test, the safeguards scale to its size, but breach notification still applies in full. Our page on penetration testing for nonprofits covers the sector.

Ready to test your defenses?

Talk to our team about what your NY SHIELD Act compliance requires.

Prefer the full scoping questionnaire? 
RelatedNYDFS 500 HIPAA FTC Safeguards

Get a Fixed-Scope Quote

Tell us what you need tested. We reply the same day.

Get a quick proposal

We are online