How to Achieve SHIELD Compliance

### Executive Summary This article explains New York’s SHIELD Act (effective March 2020), which requires organizations that handle New York residents' private information to implement reasonable administrative, technical, and physical safeguards; it expands the definition of private information to include biometric data and login credentials, broadens the breach definition, and describes enforcement penalties and exceptions. The piece also provides high-level guidance on achieving compliance (risk assessments, workforce training, vendor management, monitoring/testing) and recommends partnering with security operations providers for ongoing compliance and threat detection.