The Compliance
Convergence Problem

1. Introduction

A four-attorney firm handling real estate closings, a three-physician practice, and a two-principal registered investment adviser have little in common operationally. Each is nonetheless subject to an information-security regime that requires written policies, access controls, vendor oversight, incident response capability, and demonstrable periodic review. In each case those requirements were drafted with reference to institutions possessing dedicated compliance staff.

The conventional framing treats this as a resource problem: small firms lack the budget for enterprise compliance. That framing is incomplete and leads to unproductive conclusions. The controls at issue are, in the main, not expensive — multi-factor authentication, encryption, access review, and documented procedure are within reach of any firm at this scale. What small firms actually lack is the apparatus for deciding and recording: the mechanism by which an organization determines what is reasonable for its circumstances, implements accordingly, and preserves evidence of the reasoning.

This distinction matters because nearly every regime discussed below is written in terms of reasonableness rather than prescription, and reasonableness is established evidentially. A firm that has implemented strong controls without documenting why is in a materially weaker position than a firm with moderate controls and a clear decision record — a proposition that strikes most practitioners as backwards until they encounter an examination.

2. Five Regimes, One Control Set

The regimes below emerged from different regulators, at different times, for different purposes. Their convergence on a common core is not the product of coordination; it reflects independent arrival at the same conclusions about what adequate information security requires.

2.1 HIPAA Security Rule

Applicable to covered entities and business associates, the Security Rule requires administrative, physical, and technical safeguards for electronic protected health information, anchored by a risk analysis obligation. Its longstanding “addressable” category permitted documented, capacity-based variance in implementation — the most explicit accommodation for small entities in any of the regimes surveyed here. Proposed modernization published in January 2025 would eliminate that category, a development discussed in §4.

2.2 FTC Safeguards Rule

Promulgated under the Gramm-Leach-Bliley Act and substantially amended with provisions becoming fully enforceable in June 2023, the Safeguards Rule reaches a broader set of “financial institutions” than practitioners often assume — including, in various circumstances, tax preparers, mortgage brokers, and certain advisers. It requires a written information security program, designation of a Qualified Individual to oversee it, risk assessment, access controls, encryption, multi-factor authentication, service-provider oversight, and periodic reporting.

2.3 SEC Regulation S-P, as amended

The Commission adopted amendments to Regulation S-P in May 2024 requiring covered institutions — broker-dealers, investment companies, and registered investment advisers — to maintain written incident response programs addressing unauthorized access to customer information, and to notify affected individuals within thirty days of becoming aware that sensitive customer information was or was reasonably likely to have been accessed. Compliance dates were staged by entity size, with smaller entities afforded a longer runway. The thirty-day notification obligation is the operative change: it converts incident response from a recommended practice into a timed procedural requirement.

2.4 New York: SHIELD Act and Part 500

New York’s SHIELD Act imposes reasonable-safeguards obligations on any person or business holding private information of New York residents, with data-security requirements effective from March 2020, and expressly contemplates scaled compliance for small businesses. Separately, 23 NYCRR Part 500 imposes considerably more prescriptive requirements on entities regulated by the Department of Financial Services, including named CISO designation and governing-body reporting, with limited exemptions for the smallest covered entities.

2.5 Professional Conduct Obligations

Attorneys operate under a parallel regime that is not information-security regulation in form but functions as one. Rule 1.6(c) of the New York Rules of Professional Conduct requires reasonable efforts to prevent unauthorized disclosure of client information, and ABA Formal Opinions 477R (2017) and 483 (2018) address secure communication and post-breach obligations respectively. The enforcement mechanism is disciplinary rather than regulatory, and the operative standard is again reasonableness assessed after the fact.

Table 1. Convergence of required controls across five regimes. ● = explicitly required or squarely implied by the regime’s text; ○ = expected in practice or reachable through the regime’s general reasonableness standard without explicit enumeration. Applicability is entity-specific; the table describes the regimes, not any particular firm’s obligations.

3. The Compliance Multiplier

Table 1 supports a practical conclusion that is easily missed when compliance is approached one regime at a time. Nine controls appear across five regimes. A firm subject to two or three of them — a common circumstance for a practice that handles both health and financial information, or a firm serving clients in multiple regulated sectors — is not facing two or three separate compliance programs. It is facing one program with multiple audiences.

The regime-by-regime approach produces predictable waste: parallel policy documents that describe the same controls in different vocabularies, separate risk assessments conducted on different schedules, and vendor reviews repeated for each regime. It also produces a subtler harm. Documents drafted to satisfy a specific regulator tend to be written defensively, and defensive documents are generally poor operational guidance. Staff do not follow them, which means the controls described are not the controls operating — a discrepancy that surfaces at the worst possible moment.

The alternative is to build the common core once, mapped to a neutral reference framework, and then generate regime-specific views from it. NIST Cybersecurity Framework 2.0 serves adequately as the neutral layer for most small firms; its Govern function, added in the 2024 revision, aligns closely with the named-accountability and periodic-reporting requirements appearing in the right-hand columns of Table 1. The regime-specific work then reduces to a mapping exercise and the handful of genuinely regime-unique obligations — business associate agreements under HIPAA, the thirty-day notification clock under Regulation S-P, the CISO report to the governing body under Part 500.

4. The Narrowing of Scaled Compliance

Every regime surveyed contains some accommodation for organizational scale. Those accommodations are narrowing, and the trajectory matters more than the current state.

HIPAA’s addressable category was the most explicit: covered entities could document why a given implementation specification was not reasonable and appropriate for their environment and implement an equivalent alternative. The January 2025 proposal would eliminate the distinction, making specifications required subject to narrow exceptions. The Safeguards Rule exempts institutions maintaining information on fewer than five thousand consumers from certain requirements — a threshold that captures many small firms but is defined by record count rather than firm size, and is therefore easier to exceed than practitioners expect. Regulation S-P staged compliance dates by entity size but did not reduce substantive obligations. Part 500 provides limited exemptions determined by employee count, revenue, and asset thresholds.

The pattern across these is consistent: scale accommodations are shifting from substantive relief, in which small entities were held to a different standard, toward procedural relief, in which small entities are held to the same standard on a longer timeline or with lighter reporting. That shift substantially raises the value of the documented decision record described in §1. Where the standard is uniform and the accommodation is temporal, the firm’s ability to demonstrate reasoned implementation becomes its principal protection.

5. Practical Sequence for Small Firms

Determine applicability precisely. Firms routinely misjudge which regimes apply. The Safeguards Rule’s definition of financial institution is broader than the term suggests; SHIELD reaches any business holding private information of New York residents regardless of where the business sits; a firm may be a HIPAA business associate without being a covered entity. This determination warrants specific legal input and is inexpensive relative to the cost of getting it wrong.

Build the common core, not the regime. Implement the nine controls in Table 1 as a single program mapped to NIST CSF 2.0, then map outward to each applicable regime. Maintain one risk assessment, one vendor inventory, one incident response plan.

Document decisions, including declines. The single highest-value habit available to a small firm is recording what was considered, what was chosen, and why — including controls deliberately not implemented and the reasoning behind that. A documented, reasoned decline is defensible. An undocumented gap is indistinguishable from negligence.

Name someone. Three of the five regimes require a designated individual, and the requirement is spreading. In a small firm this person will not be a full-time security professional; the designation is nonetheless meaningful because it establishes that someone owns the program.

Test the incident plan before you need it. Regulation S-P’s thirty-day notification clock and comparable timelines elsewhere are unforgiving of plans that have never been exercised. A short annual tabletop exercise is sufficient at this scale and produces an artifact examiners consistently request.

6. Limitations

This article surveys regimes at a level of generality appropriate to comparative analysis and does not substitute for regime-specific legal review. Applicability determinations, exemption thresholds, and compliance dates are fact-specific and change; the survey reflects published rulemaking as of the date of writing, and the HIPAA proposal discussed in §4 remains proposed. Table 1 characterizes regimes rather than firms, and the distinction between explicit requirement and practical expectation involves interpretive judgment on which reasonable practitioners differ. The analysis is United States–specific and does not address state regimes beyond New York, several of which impose materially different obligations. Finally, the claim in §3 that a unified program outperforms regime-by-regime compliance is grounded in practitioner reasoning rather than comparative empirical study.

7. Conclusion

The convergence documented here is, on balance, favorable to small firms — a conclusion that runs against the prevailing sentiment. Five regulators independently requiring approximately the same nine controls means that a firm building those controls well is substantially compliant across regimes it may not have realized applied to it. The burden is real but it is not multiplicative.

What is genuinely burdensome is the evidentiary expectation, and it is rising as scale accommodations narrow. The firms that will manage this well are not those that spend the most, but those that decide deliberately, implement proportionately, and write down why. That discipline costs very little and is, at present, uncommon enough to constitute a meaningful advantage when a firm is examined.