Data Privacy Interactive Map - New York

Highlights

Covered Entities: Any person or business which owns or licenses computerized data which includes private information.

Consumer Notification: Notification must be provided to any New York resident whose private information was, or is reasonably believed to have been, accessed or acquired by a person without valid authorization.

Regulatory Notification: In the event any New York residents are to be notified, notification must be provided to the New York Attorney General, New York Department of State, New York Division of State Police, and the Department of Financial Services. However, notice to the Department of Financial Services shall only be required if the person or business is a covered entity, as defined in 23 NYCRR 500.1.

Notification Timeline: Notification must be provided in the most expedient time possible and without unreasonable delay, provided that such notification shall be made within 30 days after the breach has been discovered, except for the legitimate needs of law enforcement.

Data Format: Electronic.

Citations: N.Y. Gen. Bus. Law § 899-aa.

More Details

Definitions

• Breach: The unauthorized access to or acquisition of, or access to or acquisition without valid authorization, of computerized data that compromises the security, confidentiality, or integrity of private information maintained by a business.
  
  In determining whether information has been accessed, or is reasonably believed to have been accessed, by an unauthorized person or a person without valid authorization, entities may consider, among other factors, indications that the information was viewed, communicated with, used, or altered by a person without valid authorization or by an unauthorized person. In determining whether information has been acquired, or is reasonably believed to have been acquired, by an unauthorized person or a person without valid authorization, entities may consider the following factors, among others: indications of (1) physical possession and control of the data, (2) downloading or copying of the data, or (3) use of the data by an authorized person.

• Personal Information: Any information concerning a natural person which, because of name, number, personal mark, or other identifier, can be used to identify such natural person.

• Private Information: Any personal information in combination with any one or more of the following data elements or the combination of Personal Information plus the data element is not encrypted, or is encrypted with an encryption key that has also been accessed or acquired:

  • Social Security number or tax identification number;
  • Driver’s license number or non-driver identification card number;
  • Account number, credit or debit card number, in combination with any required security code, access code, password or other information that would permit access to an individual's financial account;
  • Account number, credit or debit card number, if circumstances exist wherein such number could be used to access an individual's financial account without additional identifying information, security code, access code, or password; or
  • Biometric information, meaning data generated by electronic measurements of an individual's unique physical characteristics, such as a fingerprint, voice print, retina or iris image, or other unique physical representation or digital representation of biometric data which are used to authenticate or ascertain the individual's identity.
  • Any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional;
  • An individual’s health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual or any information in an individual's application and claims history, including but not limited to, appeals history; or
  • A username or e-mail address in combination with a password or security question and answer that would permit access to an online account.

Safe Harbors

• Encryption: Notification is not required where the potentially impacted PI was encrypted, so long as the encryption key was not also accessed or acquired.
• Good Faith: Good faith access to, or acquisition of, private information by an employee or agent of the business for the purposes of the business is not a breach of the security of the system, provided that the private information is not used or subject to unauthorized disclosure.
• Risk of Harm: “Notice to affected persons under this section is not required if the exposure of private information was an inadvertent disclosure by persons authorized to access private information, and the person or business reasonably determines such exposure will not likely result in misuse of such information, or financial harm to the affected persons or emotional harm in the case of unknown disclosure of online credentials.” In the event of such a determination, the entity must document the determination in writing and maintain it for at least five (5) years. If the incident affects over 500 New York residents, the person or business shall provide the written determination to the state Attorney General within 10 days after the determination.
• Law Enforcement Delay: Notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation.

Consumer Notice

• Timing: Notification must be provided in the most expedient time possible and without unreasonable delay provided that such notification shall be made within thirty days after the breach has been discovered, except for the legitimate needs of law enforcement.
• Content: Regardless of the method by which notice is provided, the notice must include:
  • Contact information for the person or business making the notification;
  • Telephone numbers and websites of the relevant state and federal agencies that provide information regarding security breach response and identify theft prevention of protection information; and
  • A description of the categories of information that were, or are reasonably believed to have been, accessed or acquired by a person without valid authorization, including specification of which of the elements of personal information and private information were, or are reasonably believed to have been, so accessed or acquired.
• Method: (a) Written notice; (b) electronic notice provided that the person to whom notice is required has expressly consented to receiving said notice in electronic form and a log of each such notification is kept by the person or business who notifies affected persons in such form; provided further, however, that in no case shall any person or business require a person to consent to accepting said notice in said form as a condition of establishing any business relationship or engaging in any transaction; (c) by telephone notification, provided that a log of each such notification is kept by the person or business who notified affected persons; or (d) substitute notice, if a business demonstrates that either (1) the cost of providing notice would exceed $250,000, (2) the notification population exceeds 500,000, or (3) the entity does not have sufficient contact information. Substitute notice must include: (1) email notice, where an email address is available, “except if the breached information includes an e-mail address in combination with a password or security question and answer that would permit access to the online account”; (2) conspicuous posting on the entity’s webpage; and (3) notice to statewide media.

Remediation Services

N/A

Regulatory Notice:

Notification must be provided to the New York Attorney General, New York Department of State, New York Division of State Police, and the Department of Financial Services if any New York resident is required to be notified of a breach. The notice must include the timing, content, and distribution method of the notice to affected New York residents; the approximate number of affected individuals; and a copy of a template of the notice sent to affected individuals.

Credit Reporting Agencies Notice

In the event more that 5,000 New York residents are notified, the entity must also notify consumer reporting agencies as to the timing, content and distribution of the notices and approximate number of affected persons. Such notice shall be made without delaying notice to affected New York residents.

Third-Party Notice

Immediately following discovery of the breach, an entity must notify the owner or licensee of the breach if the PI is maintained on behalf of another entity, provided that such notification shall be made within thirty days following discovery, if the private information was, or is reasonably believed to have been, accessed or acquired by a person without valid authorization.

HIPAA

Any Covered Entity must provide notification to the state Attorney General within 5 business days of notifying the Secretary of Health and Human Services required to provide notification of a breach, including breach of information that is not “private information,” pursuant to HIPAA or the HITECH Act.

Private Action

N/A

Associated Regulations

• N.Y. State Tech. Law § 208.
• NY Department of Financial Services (NYDFS) Cybersecurity Regulation (23 NYCRR 500).

Highlights

Covered Entities: A person or entity that owns or licenses personal information of New York residents.

First Party Security Standard: Any person or business that owns or licenses computerized data which includes private information of a resident of New York shall develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information including, but not limited to, disposal of data.

Third Party Security Standard: N/A

Disposal/Destruction Standard: N/A

Data Format: Electronic.

Citations: N.Y. Gen. Bus. Law § 899-bb

More Details

Definitions:

• Private Information (PI): Personal information (i.e., any information concerning a natural person which, because of name, number, personal mark, or other identifier, can be used to identify such natural person) consisting of any information in combination with any one or more of the following data elements, when either the data element or the combination of personal information plus the data element is not encrypted, or is encrypted with an encryption key that has also been accessed or acquired:
  
  • Social Security number;
  • Driver’s license number or non-driver identification card number;
  • Account number, credit or debit card number, in combination with any required security code, access code, password or other information that would permit access to an individual's financial account;
  • Account number, credit or debit card number, if circumstances exist wherein such number could be used to access an individual's financial account without additional identifying information, security code, access code, or password;
  • Biometric information, meaning data generated by electronic measurements of an individual's unique physical characteristics, such as a fingerprint, voice print, retina or iris image, or other unique physical representation or digital representation of biometric data which are used to authenticate or ascertain the individual's identity;
  • Medical information, meaning any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; or
  • Health insurance information, meaning an individual's health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual or any information in an individual's application and claims history, including but not limited to, appeals history.

A username or e-mail address in combination with a password or security question and answer that would permit access to an online account.

PI does not include publicly available information which is lawfully made available to the general public from federal, state or local government records.

• Small Business: Any person or business with (i) fewer than 50 employees; (ii) less than $3,000,000 in gross annual revenue in each of the previous 3 fiscal years; or (iii) less than $5,000,000 in year-end total assets, calculated in accordance with generally accepted accounting principles.

Methods of Compliance:

A person or business shall be deemed in compliance with New York’s “reasonable security” requirement if it implements a data security program that includes:

• Reasonable administrative safeguards such as: (i) designation of one (1) or more employees to coordinate the security program; (ii) identification of reasonably foreseeable internal and external risks; (iii) assessment of the sufficiency of safeguards in place to control the identified risks; (iv) training and management of employees in the security program practices and procedures; (v) selection of service providers capable of maintaining appropriate safeguards, and requiring those safeguards by contract; and (vi) adjustment of the security program in light of business changes or new circumstances;
• Reasonable technical safeguards such as: (i) assessment of risks in network and software design; (ii) assessment of risks in information processing, transmission, and storage; (iii) detection, prevention, and response to attacks or system failures; and (iv) regular testing and monitoring of the effectiveness of key controls, systems, and procedures; and
• Reasonable physical safeguards such as: (i) assessment of risks of information storage and disposal; (ii) detection, prevention, and response to intrusion; (iii) protection against unauthorized access to or use of private information during or after the collection, transportation, and destruction or disposal of the information; (iv) disposal of private information within a reasonable amount of time after it is no longer needed for business purposes by erasing electronic media so that the information cannot be read or reconstructed.

Small businesses are deemed in compliance with the safeguard requirements if the business’ security program contains reasonable administrative, technical, and physical safeguards that are appropriate for the size and complexity of the small business, the nature and scope of the small business’ activities, and the sensitivity of the personal information the small business collects from or about consumers.

Exclusions:

• Health Care: Any person or business that is subject to, and in compliance with, regulations implementing HIPAA and the HITECH Act is deemed in compliance.
• Financial: Any person or business that is subject to, and in compliance with, regulations promulgated pursuant to the GLBA is deemed in compliance. Any person or business that is subject to, and in compliance with, the NYDFS Cybersecurity Requirements for Financial Services Companies is deemed in compliance.
• Other: Any person or business that is subject to, and in compliance with, any other data security rules and regulations of, and statutes administered by, any official department, division, commission or agency of the federal or New York state government as such rules, regulations or statutes are interpreted by such department, division, commission, or agency, or by the federal or New York state courts is deemed in compliance.

Enforcement/Penalties:

Violations of N.Y. Gen. Bus. Law § 899-bb are deemed deceptive acts and practices. The New York Attorney General may bring an action on behalf of the people of the state of New York to enjoin violations and to obtain civil penalties. Violations may result in a civil penalty of up to $15,000 for each violation or three (3) times the restitution needed, whichever is greater. No private right of action exists under this section.

Associated Regulations:

N/A

Highlights

Applicability:

DFS-regulated individuals and entities required to comply with the Cybersecurity Regulation (referred to below as “Covered Entities”) include, but are not limited to, individuals, partnerships, corporations, branches, agencies, and associations operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation, or similar authorization under the New York Banking Law, the New York Insurance Law, or the New York Financial Services Law.

Non-Public Information:

• Business-related information of a covered entity the tampering with which, or unauthorized disclosure, access or use of which, would cause a material adverse impact to the business, operations or security of the covered entity;
• Any information concerning an individual which, because of name, number, personal mark, or other identifier can be used to identify such individual, in combination with any one or more of the following data elements:
  • Social Security number;
  • Driver's license number or non-driver identification card number;
  • Account number, credit or debit card number;
  • Any security code, access code or password that would permit access to an individual's financial account; or
  • Biometric records;
• Any information or data, except age or gender, in any form or medium created by or derived from a health care provider or an individual and that relates to:
  • The past, present or future physical, mental or behavioral health or condition of any individual or a member of the individual's family;
  • The provision of health care to any individual; or
  • Payment for the provision of health care to any individual.

Annual Certification:

A senior officer or the covered entity’s senior governing body, as defined by the Cybersecurity Regulation, must annually certify compliance with the regulation.

Cybersecurity Program Requirements:

Each covered entity shall maintain a risk-based cybersecurity program designed to protect the confidentiality, integrity, and availability of the covered entity’s information systems and nonpublic information stored on those information systems. The cybersecurity program shall address the “core cybersecurity functions” enumerated in the Cybersecurity Regulation.

Additional key components include, but are not limited to:

• Covered entities may be required to designate a CISO responsible for compliance with the Cybersecurity Regulation. The CISO must report in writing annually to the senior governing body on the covered entity’s cybersecurity program and other topics related to cyber risk. Section 500.4.
• The covered entity’s senior governing body shall exercise oversight of the covered entity’s cybersecurity risk management. Section 500.4(6).
• Certain covered entities may be required to design and conduct independent audits of its cybersecurity program. Section 500.2(c).
• Covered entities may be required to conduct penetration testing at least annually and conduct automated and/or manual scans of information systems to identify vulnerabilities, and timely remediate the same. Section 500.5.
• Covered entities may be required to implement access privilege and management requirements, including, where applicable, utilization of a privileged access management solution and an automated solution to block commonly-used passwords. Section 500.7.
• Covered entities may be required to adopt written procedures, guidelines, and standards for in-house developed applications to ensure secure development practices, as well as procedures to evaluate, assess, or test the security of externally-developed applications. Section 500.8.
• Covered entities must utilize multi-factor authentication for system access, or reasonably equivalent or more secure compensating controls approved in writing by the CISO. Section 500.12.
• Covered entities must provide periodic, but at a minimum annual, cybersecurity awareness that includes social engineering for all personnel that reflects the risks identified in the covered entity’s risk assessment. Section 500.14(a).
• Certain covered entities must implement an endpoint detection and response solution to monitor for anomalous activity, including but not limited to lateral movement, as well as a centralized logging and security event alerting solution. Section 500.14(b).
• Covered entities must implement encryption to protect nonpublic information held or transmitted by the covered entity, or, if infeasible, an effective alternative compensating control approved in writing by the CISO. Section 500.15.
• Covered entities must implement business continuity, disaster recovery, and incident response plan(s) to respond to and recover from cybersecurity events, which plan(s) must be tested at a minimum annually. Section 500.16.
• Covered entities must, at a minimum, test their ability to restore critical data and information systems from backups. Section 500.16.

Cybersecurity Policy Requirements:

Each covered entity shall implement and maintain a written policy or policies, approved at least annually by a senior officer or the covered entity's senior governing body for the protection of its information systems and nonpublic information stored information systems. Procedures shall be developed, documented and implemented in accordance with the written policy or policies. The cybersecurity policy or policies and procedures shall be based on the covered entity's risk assessment and address, at a minimum, the following areas to the extent applicable to the covered entity's operations:

• Information security;
• Data governance, classification and retention;
• Asset inventory, device management and end of life management;
• Access controls, including remote access and identity management;
• Business continuity and disaster recovery planning and resources;
• Systems operations and availability concerns;
• Systems and network security and monitoring;
• Security awareness and training;
• Systems and application security and development and quality assurance;
• Physical security and environmental controls;
• Customer data privacy;
• Vendor and third-party service provider management;
• Risk assessment;
• Incident response and notification; and
• Vulnerability management.

Risk Assessment:

At least annually a risk assessment must be conducted to identify and address cybersecurity risks. The risk assessment shall allow for revision of controls to respond to technological developments and evolving threats and shall consider the particular risks of the covered entity's business operations related to cybersecurity, nonpublic information collected or stored, information systems utilized and the availability and effectiveness of controls to protect nonpublic information and information systems.

Third-Party Requirements:

Each covered entity shall implement written policies and procedures designed to ensure the security of information systems and nonpublic information that are accessible to, or held by, third-party service providers. Such policies and procedures shall be based on the risk assessment of the covered entity and shall address to the extent applicable:

• The identification and risk assessment of third-party service providers;
• Minimum cybersecurity practices required to be met by such third-party service providers in order for them to do business with the covered entity;
• Due diligence processes used to evaluate the adequacy of cybersecurity practices of such third-party service providers; and
• Periodic assessment of such third-party service providers based on the risk they present and the continued adequacy of their cybersecurity practices.

Such policies and procedures shall include relevant guidelines for due diligence and/or contractual protections relating to third-party service providers including to the extent applicable guidelines addressing:

• The third-party service provider's policies and procedures for access controls, including its use of multi-factor authentication as required by section 500.12 of this Part, to limit access to relevant information systems and nonpublic information;
• The third-party service provider's policies and procedures for use of encryption as required by section 500.15 of this Part to protect nonpublic information in transit and at rest;
• Notice to be provided to the covered entity in the event of a cybersecurity event directly impacting the covered entity's information systems or the covered entity's nonpublic information being held by the third-party service provider; and
• Representations and warranties addressing the third-party service provider's cybersecurity policies and procedures that relate to the security of the covered entity's information systems or nonpublic information.

Notice of Cybersecurity Incident: 

Each covered entity shall notify the superintendent via the department’s website as promptly as possible but in no event later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, its affiliates, or a third-party service provider.

Each covered entity shall promptly provide to the superintendent any information requested regarding such incident. Covered entities shall have a continuing obligation to update the superintendent with material changes or new information previously unavailable.

Notice of Compliance:

Annually each covered entity shall submit to the superintendent electronically by April 15 either:

• A written certification that:
  • Certifies that the covered entity materially complied with the requirements set forth in this Part during the prior calendar year; and
  • Shall be based upon data and documentation sufficient to accurately determine and demonstrate such material compliance, including, to the extent necessary, documentation of officers, employees, representatives, outside vendors and other individuals or entities, as well as other documentation, whether in the form of reports, certifications, schedules or otherwise; or
• A written acknowledgment that:
  • Acknowledges that, for the prior calendar year, the covered entity did not materially comply with all the requirements of this Part;
  • Identifies all sections of this Part that the entity has not materially complied with and describes the nature and extent of such noncompliance; and
  • provides a remediation timeline or confirmation that remediation has been completed.

Notice and Explanation of Extortion Payment:

• Each covered entity, in the event of an extortion payment made in connection with a cybersecurity event involving the covered entity, shall provide the superintendent electronically, in the form set forth on the department's website, with the following:
  • Within 24 hours of the extortion payment, notice of the payment; and
  • Within 30 days of the extortion payment, a written description of the reasons payment was necessary, a description of alternatives to payment considered, all diligence performed to find alternatives to payment and all diligence performed to ensure compliance with applicable rules and regulations including those of the Office of Foreign Assets Control.

More Details

Definitions:

• Affiliate: Any individual or entity that controls, is controlled by or is under common control with another entity. For purposes of this subdivision, control means the possession, direct or indirect, of the power to direct or cause the direction of the management and policies of an individual/entity, whether through the ownership of stock of such individual/entity or otherwise.
• Authorized User: Any employee, contractor, agent or other person that participates in the business operations of a covered entity and is authorized to access and use any information systems and data of the covered entity.
• Chief Information Security Officer (CISO): A qualified individual responsible for overseeing and implementing a covered entity's cybersecurity program and enforcing its cybersecurity policy.
• Covered Entity: Any individual/entity operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law, regardless of whether the covered entity is also regulated by other government agencies.
• Cybersecurity Event: Any act or attempt, successful or unsuccessful, to gain unauthorized access to, disrupt or misuse an information system or information stored on such information system.
• Cybersecurity Incident: A cybersecurity event that has occurred at the covered entity, its affiliates, or a third-party service provider that:
  • Impacts the covered entity and requires the covered entity to notify any government body, self-regulatory agency or any other supervisory body;
  • Has a reasonable likelihood of materially harming any material part of the normal operation(s) of the covered entity; or
  • Results in the deployment of ransomware within a material part of the covered entity's information systems.
• Independent Audit: An audit conducted by internal or external auditors free to make decisions not influenced by the covered entity being audited or by its owners, managers or employees.
• Information System: A discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of electronic information, as well as any specialized system such as industrial/process controls systems, telephone switching and private branch exchange systems, and environmental control systems.
• Multi-Factor Authentication: Authentication through verification of at least two of the following types of authentication factors:
  • Knowledge factors, such as a password;
  • Possession factors, such as a token; or
  • Inherence factors, such as a biometric characteristic.
• Risk Assessment: Identifying, estimating and prioritizing cybersecurity risks to organizational operations, organizational assets, individuals, customers, consumers, other organizations and critical infrastructure resulting from the operation of an information system. Risk assessments incorporate threat and vulnerability analyses and consider mitigations provided by security controls planned or in place.

Exemptions:

• Limited exemption. Each covered entity with:
  • Fewer than 20 employees and independent contractors of the covered entity and its affiliates;
  • Less than $7,500,000 in gross annual revenue in each of the last three fiscal years from all business operations of the covered entity and the business operations in this State of the covered entity's affiliates; or
  • Less than $15,000,000 in year-end total assets, calculated in accordance with generally accepted accounting principles, including assets of all affiliates, shall be exempt from the requirements of sections 500.4, 500.5, 500.6, 500.8, 500.10, 500.14(a)(1), (a)(2), and (b), 500.15 and 500.16 of this regulation.
• An employee, agent, wholly owned subsidiary, representative or designee of a covered entity, who is itself a covered entity, is exempt from this Part and need not develop its own cybersecurity program to the extent that the employee, agent, wholly owned subsidiary, representative or designee is covered by the cybersecurity program of the covered entity.
• A covered entity that does not directly or indirectly operate, maintain, utilize or control any information systems, and that does not, and is not required to, directly or indirectly control, own, access, generate, receive or possess nonpublic information shall be exempt from the requirements of sections 500.2, 500.3, 500.4, 500.5, 500.6, 500.7, 500.8, 500.10, 500.12, 500.14, 500.15 and 500.16 of this regulation.
• A covered entity under article 70 of the Insurance Law that does not and is not required to directly or indirectly control, own, access, generate, receive or possess nonpublic information other than information relating to its corporate parent company (or affiliates) shall be exempt from the requirements of sections 500.2, 500.3, 500.4, 500.5, 500.6, 500.7, 500.8, 500.10, 500.12, 500.14, 500.15 and 500.16 of this regulation.
• An individual insurance broker subject to Insurance Law section 2104 who qualifies for the exemption pursuant to section 500.19(c) of this Part and has not, for any compensation, commission or other thing of value, acted or aided in any manner in soliciting, negotiating or selling any policy or contract or in placing risks or taking out insurance on behalf of another person for at least one year shall be exempt from the requirements of this Part, provided such individuals do not otherwise qualify as a covered entity for purposes of this regulation.
• A covered entity that qualifies for any of the above exemptions pursuant to this section shall file electronically a Notice of Exemption in the form set forth on the department's website within 30 days of the determination that the covered entity is exempt.
• The following persons are exempt from the requirements of this Part, provided such persons do not otherwise qualify as a covered entity for purposes of this Part:
  • Persons subject to Insurance Law section 1110;
  • Persons subject to Insurance Law section 5904;
  • Any accredited reinsurer, certified reinsurer or reciprocal jurisdiction reinsurer that has been so recognized pursuant to 11 NYCRR Part 125;
  • Individual insurance agents who are placed in inactive status under Insurance Law section 2103; and individual licensees placed in inactive status under Banking Law section 599-i.

Enforcement:

This regulation will be enforced by the superintendent pursuant to, and is not intended to limit, the superintendent's authority under any applicable laws.

The commission of a single act prohibited by this regulation or the failure to act to satisfy an obligation required by this regulation shall constitute a violation hereof.

In assessing any penalty for a violation of this regulation pursuant to the Banking Law, Insurance Law or Financial Services Law, the superintendent shall take into account, without limitation, factors including:

• The extent to which the covered entity has cooperated with the superintendent in the investigation of such acts;
• The good faith of the entity;
• Whether the violations resulted from conduct that was unintentional or inadvertent, reckless or intentional and deliberate;
• Whether the violation was a result of failure to remedy previous examination matters requiring attention, or failing to adhere to any disciplinary letter, letter of instructions or similar;
• Any history of prior violations;
• Whether the violation involved an isolated incident, repeat violations, systemic violations or a pattern of violations;
• Whether the covered entity provided false or misleading information;
• The extent of harm to consumers;
• Whether required, accurate and timely disclosures were made to affected consumers;
• The gravity of the violations;
• The number of violations and the length of time over which they occurred;
• The extent, if any, to which the senior governing body participated therein;
• Any penalty or sanction imposed by any other regulatory agency;
• The financial resources, net worth and annual business volume of the covered entity and its affiliates;
• The extent to which the relevant policies and procedures of the company are consistent with nationally recognized cybersecurity frameworks, such as NIST; and
• Such other matters as justice and the public interest require.