Most owners have a rough sense they "should" be compliant with something — but not which framework, or what it actually requires technically. One map, four verticals, no guessing.
ABA Model Rule 1.6 makes client confidentiality an ethical obligation, not just a best practice — and NY State Bar guidance extends that to how you secure client data technically: encryption, secure remote access, matter-management security, and incident response.
HIPAA's Security Rule requires 12 specific administrative, physical, and technical safeguards for any practice handling PHI — from MFA and encryption to a named Security Officer and signed Business Associate Agreements with every vendor that touches patient data.
NY-regulated financial firms typically carry two separate obligations at once: NYS DFS's cybersecurity regulation (board oversight, MFA, vulnerability management, annual certification) and FINRA/SEC record retention rules (WORM storage, immutable email archiving, retention schedules by record type).
Don't fall into a regulated vertical? New York's SHIELD Act still applies if you hold any NY resident's private information — it requires "reasonable" administrative, technical, and physical safeguards, and a breach-notification obligation if that data is exposed.
Looking for a scored assessment instead of a map? Our Free IT Risk Scorecard covers general IT risk today — a dedicated Compliance Readiness Scorecard specific to each framework above is planned but not yet built.
Book a free 30-minute Risk Review. Wlad will identify exactly which regulations govern your business and where your current IT falls short — at no charge.
Schedule My Free Risk Review →Questions first? Send us a message or call (516) 734-1515
