Which cybersecurity compliance rules apply to a small business? It depends on the data you handle and who you serve, not on how many people you employ. Most small businesses fall under at least one: PCI DSS if you accept card payments, state breach notification laws if you keep customer information, HIPAA if you work in or with healthcare, and the FTC Safeguards Rule if you offer financial services such as tax preparation, lending, or dealer financing. On top of the law, customers and cyber insurers increasingly require specific security controls by contract.
This guide explains which rules are likely to apply to you, what they ask for in plain terms, and the core controls that satisfy most of them at once. It focuses on businesses in New York and New Jersey, but most of it applies anywhere in the United States. It is general information, not legal advice.
Key takeaways
- Compliance follows your data and your customers, not your company size. A five-person office can be covered by PCI DSS, HIPAA, and state law at the same time.
- Breach notification laws apply based on where the affected people live, not where your office is.
- New York now requires businesses to notify affected residents within 30 days of discovering a breach.
- The same core controls (MFA, encryption, access control, backups, patching, training, and an incident plan) satisfy most rules at once.
- Write it down. Most regulations and insurers want to see a written security program, not just good intentions.
Which compliance rules apply to your business
| Rule | Who it covers and what it asks for |
|---|---|
| PCI DSS | Covers: Any business that accepts card payments. Requires: Protect card data and pass a yearly review for your processor. |
| State breach laws | Covers: Any business holding residents' personal information. Requires: Notify affected people, and sometimes state agencies, after a breach. |
| NY SHIELD Act | Covers: Businesses holding private information of New York residents. Requires: Reasonable safeguards for that data. |
| New Jersey Data Privacy Act | Covers: Businesses handling data of 100,000 NJ consumers, or 25,000 if they sell personal data. Requires: Privacy notices, consumer rights requests, and data protection. |
| HIPAA | Covers: Healthcare providers, health plans, and the vendors that handle their patient data. Requires: Risk analysis, safeguards, and business associate agreements. |
| FTC Safeguards Rule | Covers: Non-bank financial businesses such as tax preparers, mortgage brokers, and auto dealers that arrange financing. Requires: A written security program, MFA, encryption, and breach reporting. |
| NYDFS Part 500 | Covers: Companies licensed by New York's Department of Financial Services, such as insurance agencies. Requires: A cybersecurity program, MFA, and an annual filing by April 15. |
| CMMC | Covers: Defense contractors handling federal contract or controlled information. Requires: A self review or an outside audit. |
PCI DSS
The Payment Card Industry Data Security Standard applies to every business that takes card payments, however small. Most small merchants complete an annual self-assessment questionnaire for their payment processor. The current version, PCI DSS 4.0.1, has applied in full since March 31, 2025. Using a processor's hosted payment page or terminal keeps card data off your own systems and shrinks what you have to prove.
New York: the SHIELD Act and the 30-day breach rule
New York's SHIELD Act requires any business that holds New York residents' private information to keep reasonable safeguards in place, scaled to its size and the sensitivity of the data. Since December 2024, New York also requires businesses to notify affected residents within 30 days of discovering a breach, and the definition of private information now includes medical and health insurance information. Businesses regulated by the Department of Financial Services must also notify DFS.
New Jersey: breach notification and the Data Privacy Act
New Jersey requires businesses to notify affected residents of a breach without unreasonable delay, and to report to the New Jersey State Police before notifying customers. The New Jersey Data Privacy Act, in effect since January 2025, applies to businesses that handle the personal data of at least 100,000 New Jersey consumers a year, or at least 25,000 if they earn revenue from selling personal data. There is no minimum revenue, and the grace period that let businesses fix problems before enforcement ended in July 2026.
HIPAA
HIPAA applies to medical, dental, and mental health practices of every size, and to the vendors that handle their patient data, including IT providers, billing services, and cloud platforms. The current Security Rule requires a risk analysis, safeguards for electronic health information, and business associate agreements with vendors. A major update to the Security Rule was proposed in January 2025, but as of October 2026 it has not been finalized. The current rule remains fully enforceable.
The FTC Safeguards Rule
The FTC Safeguards Rule covers many businesses that do not think of themselves as financial institutions, including tax preparers, mortgage brokers, payday lenders, and car dealers that arrange financing. It requires a written information security program with a designated person in charge, multi-factor authentication, encryption, and regular testing. Since May 2024, covered businesses must report breaches affecting 500 or more consumers to the FTC within 30 days.
New York DFS licensees: 23 NYCRR Part 500
The New York Department of Financial Services cybersecurity regulation, 23 NYCRR Part 500, applies to any business licensed, registered, or chartered under New York's Banking, Insurance, or Financial Services laws. For small businesses, that most often means insurance agencies and brokers, mortgage brokers and bankers, and licensed lenders. It applies wherever your office is, and even if another agency also regulates you. The final phase of the 2023 amendments took effect in November 2025, so every requirement now applies.
What smaller licensees still have to do
Licensees with fewer than 20 employees and independent contractors, or below DFS's revenue or asset thresholds, can claim a limited exemption under section 500.19(a). It removes some requirements, including a chief information security officer, penetration testing, audit trails, encryption, and a formal incident response plan. Most of the core still applies. According to DFS's small business guidance, an exempt licensee must still:
- Maintain a cybersecurity program based on a risk assessment.
- Keep written cybersecurity policies, approved at least once a year.
- Limit access privileges and, if you use passwords, keep a written password policy.
- Review and update the risk assessment at least annually.
- Keep written policies for vendors that can access your systems or nonpublic information.
- Use multi-factor authentication for remote access, third-party applications that reach nonpublic information, and privileged accounts.
- Maintain an up-to-date asset inventory and securely dispose of nonpublic information you no longer need.
- Give all staff cybersecurity awareness training, including social engineering, at least once a year.
- File the required notices with DFS.
Licensees that do not qualify for the exemption must meet the full regulation, including a designated CISO, encryption, vulnerability management, an incident response plan, and multi-factor authentication for anyone who accesses their information systems. Even when encryption and an incident plan are not required, they remain good practice.
Deadlines that apply to every licensee
- April 15 each year: file either a Certification of Material Compliance or an Acknowledgment of Noncompliance for the prior calendar year. An acknowledgment must list the gaps and a timeline to fix them. The filing is signed by your highest-ranking executive and your CISO, or the senior officer responsible for cybersecurity.
- 72 hours: report a cybersecurity incident to DFS no later than 72 hours after determining it occurred.
- 24 hours and 30 days: report any ransom or extortion payment within 24 hours, then explain in writing within 30 days why it was necessary.
- Five years: keep the records that support your annual filing.
The April filing is where gaps tend to surface. If you are not sure you can certify compliance, our IT audit and compliance services can review your program, close the gaps, and help you collect the evidence behind the filing.
Other rules that may apply
Defense contractors need to meet CMMC, whose rollout schedule changed in 2026, so check the current Department of Defense guidance. If you have customers in Europe or California, GDPR or the CCPA may apply once you meet their thresholds.
Compliance by contract
Even when no law names your business, your customers and insurers may. Larger clients send security questionnaires, and cyber insurers require controls such as MFA, backups, and endpoint protection before they will issue or renew a policy. Our cyber insurance advisory helps businesses answer those questionnaires accurately.
What compliance standards apply to a company with 1 to 249 employees?
For most companies in this range, the baseline is PCI DSS if you take cards, the breach notification laws of every state where your customers live, and any contract or insurance requirements. Add HIPAA if you touch patient data, the FTC Safeguards Rule if you provide financial services, and NYDFS Part 500 if you hold a DFS license. Headcount rarely creates an exemption on its own. When a rule does scale down, like New York's SHIELD Act, it usually asks for safeguards that fit your size rather than none at all.
What changes when you open in a new state
Breach notification laws follow the residents whose data you hold, so expanding into a new state, or simply gaining customers there, adds that state's rules. Rather than tracking every difference location by location, build one security program to the strictest standard you face, then check each new state's breach notification and privacy law for deadlines and thresholds. That approach keeps a growing business from running different rules in different offices.
The core controls that satisfy most rules
Different regulations use different words, but they ask for many of the same protections. Put these in place and you are most of the way toward meeting almost any of them:
- Multi-factor authentication on email, remote access, and every administrator account.
- Access control based on least privilege, with prompt removal when people leave.
- Encryption for sensitive data on laptops, in email, and in the cloud.
- Patching and endpoint protection on every computer and server.
- Backups that are tested, with at least one copy attackers cannot change.
- Logging and monitoring so suspicious activity is noticed and investigated.
- Security awareness training for every employee.
- Vendor management, including contracts that require vendors to protect your data.
- An incident response plan with named owners and notification steps.
Your written security policy
Most rules, and most insurers, expect these controls to be written down. A small business security policy does not need to be long. It should name who is responsible for security, list the controls above and how they are maintained, set rules for passwords, devices, remote work, and data handling, explain how incidents are reported and handled, and say how often the policy is reviewed. The FTC's guide to protecting personal information is a useful starting point.
Implementing effective compliance strategies
If you don't yet have a plan for staying compliant, start here.
Risk assessment
Start with a risk assessment. It shows you where your data handling is weakest, so your policies fix real problems instead of hypothetical ones. HIPAA and the FTC Safeguards Rule both require one.
Data discovery and classification
Next, find out what data you have and where it lives. Sorting information by how sensitive it is tells you what needs the most protection. Regulations like GDPR require special handling for certain types of data, so you have to know where that data is.
Access controls and encryption
Once you know what you have, lock it down. Give employees only the access their roles need, and encrypt sensitive information both at rest and in transit.
Employee training
Train your staff. Regular sessions teach people what compliance means for their job and how to spot threats. Human error causes a large share of breaches, so this step matters as much as any technology.
Using technology to stay compliant
Small businesses rarely have a compliance department. The right tools, used well, can take on a lot of the work without adding headcount.
- Compliance management tools track requirements, keep documentation organized, and produce reports for auditors and insurers.
- Monitoring tools watch your systems for suspicious activity and alert you quickly, instead of letting problems surface months later.
- Regular audits and vulnerability scans show where your program or systems have weak spots and give you a paper trail that shows you take data protection seriously.
Responding to compliance violations and incidents
Even with good controls, something will eventually go wrong. As the Federal Trade Commission advises, "Have a plan in place to respond to security incidents." Your plan should cover:
- Immediate actions to contain the incident, such as disconnecting compromised systems.
- How you will investigate the cause and extent of the breach.
- How you will preserve evidence.
- Who you must notify, and by when. In New York, that is within 30 days for affected residents. Under the FTC Safeguards Rule, it is within 30 days for breaches affecting 500 or more consumers.
Communicate quickly and honestly with customers, employees, partners, and regulators. Under GDPR, fines can reach 4% of annual global turnover or 20 million euros, whichever is greater, and US state laws carry their own penalties. Talk to a lawyer who knows the relevant state and federal laws to make sure your response meets every requirement.
How Spot On Tech helps with compliance
Most of compliance comes down to knowing which rules apply to you, putting sensible controls in place, documenting them, and having a plan for when things go wrong. Spot On Tech helps New York and New Jersey businesses with each step through our IT audit and compliance services, from mapping which rules apply to putting the controls in place and producing the evidence auditors and insurers ask for.
If you are not sure where you stand, start with a technology risk assessment or talk with Spot On Tech.
Frequently asked questions
What compliance standards apply to a small business?
It depends on your data and customers. Common ones are PCI DSS for card payments, state breach notification laws, HIPAA for healthcare, the FTC Safeguards Rule for financial services, and the NY SHIELD Act for businesses holding New York residents' information. Customer contracts and cyber insurance policies often add their own requirements.
Does HIPAA apply to small businesses?
Yes, if you are a healthcare provider, health plan, or a vendor that handles their patient data. There is no size exemption. Small practices and their IT, billing, and software vendors must follow the HIPAA Security Rule.
Do small businesses need to be PCI compliant?
Yes. Any business that accepts card payments must follow PCI DSS. Most small merchants meet it by completing an annual self-assessment and using payment terminals or hosted payment pages that keep card data off their own systems.
What is the NY SHIELD Act?
It is a New York law that requires any business holding New York residents' private information to maintain reasonable administrative, technical, and physical safeguards. It applies regardless of where the business is located, with expectations scaled to the business's size.
How long do we have to report a data breach in New York?
Since December 2024, businesses must notify affected New York residents within 30 days of discovering a breach, and also notify state agencies.
Does the New Jersey Data Privacy Act apply to small businesses?
Only if they meet its thresholds: handling the personal data of at least 100,000 New Jersey consumers a year, or at least 25,000 while earning revenue from selling personal data. New Jersey's breach notification law applies to businesses of any size.
Does 23 NYCRR 500 apply to small insurance agencies?
Yes, if the agency is licensed by the New York Department of Financial Services. Agencies with fewer than 20 employees and independent contractors, or below DFS's revenue or asset thresholds, can claim a limited exemption, but they must still use multi-factor authentication, keep written policies and a risk assessment, maintain an asset inventory, train staff, and file with DFS every year.
When is the NYDFS annual compliance filing due?
April 15 each year, covering the prior calendar year. Licensees file either a Certification of Material Compliance or an Acknowledgment of Noncompliance that lists the gaps and a remediation timeline.
What should a small business cybersecurity policy include?
Who is responsible for security, the controls you use and how they are maintained, rules for passwords, devices, remote work, and data handling, how incidents are reported and handled, and how often the policy is reviewed.
