Summary. This checklist turns the overlapping cybersecurity rules that apply to American businesses into concrete, checkable tasks. It starts with applicability and scope, then works through governance, the written risk assessment, the written program and policies, core technical controls, vendor oversight, training and testing, and incident response with every regulatory reporting clock. A regime-by-regime section covers the FTC Safeguards Rule, NYDFS Part 500, the SEC's disclosure rules and Regulation S-P, HIPAA and the Health Breach Notification Rule, defense contractor requirements, state laws, insurance, telecommunications, and critical infrastructure. It closes with board reporting and certifications, examination readiness, an annual compliance calendar, common mistakes, an FAQ, and practical takeaways. Each item cites the governing rule so that compliance teams, counsel, auditors, and examiners can trace it to its source.

Most companies that fail a cybersecurity examination did not lack security tools. They lacked a document: the risk assessment that covered only half the network, the board report no one wrote, the vendor contract with no notice clause, the MFA exception nobody approved. This checklist is built to find those gaps before an examiner, a plaintiff, or an attacker does.

How to use this checklist

  • Who uses it: the person responsible for the security program (the Qualified Individual, CISO, or security official), in-house or outside counsel, internal audit, and directors who want to know what to ask. Opposing counsel and examiners can use the same items in reverse, as a document request.
  • When: at program launch, before each annual certification or board report, before an examination, after any significant incident, and during acquisition diligence on a target.
  • How: mark each item done, not applicable (with a one-line reason), or open (with an owner and date). An item marked "not applicable" without a reason is the first thing a reviewer will question.
  • What it covers: the legal duty to secure data. Breach notification to individuals is covered in Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation; the procedural walk-through is in Building a Cybersecurity Compliance Program That Satisfies Regulators: A Practical Guide.

Part 1: Applicability and scope

  • List every legal entity in the group and every license, charter, registration, and listing each holds.
    • A New York banking, insurance, or financial services license brings in 23 NYCRR Part 500; an SEC registration or listing brings in the SEC rules below.
  • Decide whether any entity is a "financial institution" under the GLBA, meaning its business is engaging in financial activities as described in section 4(k) of the Bank Holding Company Act.
    • 15 U.S.C. § 6809; 16 C.F.R. § 314.2(h). Lenders, mortgage brokers, auto dealers that finance or lease, tax preparers, collection agencies, check cashers, money transmitters, unregistered investment advisers, and "finders" are covered.
  • Identify which regulator enforces the GLBA safeguards duty for each financial institution (banking agency, NCUA, SEC, state insurance regulator, or the FTC for everyone else).
  • Inventory regulated data types: nonpublic personal financial information, protected health information, payment card data, controlled unclassified information, children's personal information, biometric data, consumer reports, and telecommunications customer data.
  • Identify the states where data subjects live, flagging Massachusetts, New York, and California residents at a minimum.
  • Collect every contractual security obligation: customer agreements, data processing agreements, business associate agreements, merchant agreements and PCI DSS obligations, investor side letters, and cyber insurance policy conditions.
  • Collect every public statement about security: privacy policy, security or trust page, marketing claims, security questionnaire answers, SEC filings.
  • Build or update the asset inventory: systems, cloud and SaaS services, data stores, data flows, and operational technology, with owners.
  • Identify the "crown jewels": the systems whose compromise would be material or would trigger regulatory notice.
  • Decide the program structure (one enterprise program or separate programs) and document the reason.
  • Select an organizing framework (NIST CSF 2.0, CIS Controls v8.1, ISO/IEC 27001, or NIST SP 800-171 for controlled unclassified information).
  • Build the crosswalk from each legal requirement to a control, a policy, an owner, and an evidence location.
  • Write the applicability memo and have counsel review it annually and after any acquisition, new license, or new product.

Part 2: Governance and accountable people

  • Designate the program lead in writing: the Qualified Individual (16 C.F.R. § 314.4(a)), the CISO (Part 500), the HIPAA security official (45 C.F.R. § 164.308(a)(2)), and the program coordinator under state law and the COPPA Rule.
  • If the lead is outsourced, designate a senior employee to direct and oversee that person, keep responsibility in-house, and require the provider by contract to maintain a program that protects the company.
  • Document the lead's authority to direct resources and enforce policy, and the reporting line to the CEO or a board committee.
  • Assign board oversight to a named committee and amend its charter.
  • Set the board calendar: at least one annual written report from the program lead, periodic updates, and escalation criteria for significant incidents.
  • Provide director education sufficient for informed oversight, and record attendance.
    • Part 500 requires the senior governing body to have "sufficient understanding of cybersecurity-related matters to exercise such oversight."
  • Form a management steering committee with legal, privacy, compliance, IT, HR, finance, and business owners; adopt a charter; keep minutes.
  • Adopt a responsibility matrix for each control family.
  • Confirm officers understand their oversight duties in their areas of responsibility.

Part 3: Risk assessment and risk register

  • Perform a written risk assessment covering every system and data store in the inventory.
    • The Safeguards Rule requires written criteria for evaluating and categorizing risks, for assessing confidentiality, integrity, and availability, and for how each risk will be mitigated or accepted. 16 C.F.R. § 314.4(b)(1).
  • For HIPAA entities, confirm the analysis is "accurate and thorough" and enterprise-wide.
  • Identify current threats relevant to the business: ransomware, business email compromise, credential theft and help-desk social engineering, cloud misconfiguration, vendor compromise, insider misuse, and AI-enabled impersonation.
  • Feed in evidence: vulnerability scans, penetration test findings, audit reports, prior incidents, and crosswalk gaps.
  • Rate likelihood and impact with written criteria; record inherent risk, existing controls, and residual risk.
  • Assign a treatment to every risk: mitigate, transfer, avoid, or accept.
  • Obtain written acceptance of every accepted risk from someone with authority, with a review date.
  • Maintain the risk register with owners and due dates, and report aging items.
  • Schedule reassessment at least annually and upon material changes (acquisitions, new systems, major incidents, new regulations).
    • Part 500 requires annual review and updates on material change; the Safeguards Rule requires periodic reassessment, 16 C.F.R. § 314.4(b)(2).
  • Decide what, if anything, will be prepared at counsel's direction for legal advice, and structure that engagement separately from the required assessment.

Part 4: Written program and policies

  • Adopt a written information security program (WISP) stating scope, roles, risk method, policies, training, vendor oversight, incident response, testing, retention, discipline, and review cycle.
    • The program may be written "in one or more readily accessible parts." 16 C.F.R. § 314.3(a). Massachusetts requires a WISP under 201 CMR 17.03.
  • Confirm the policy set covers every Part 500 subject area: information security; data governance, classification, and retention; asset inventory and device management; access control and identity; business continuity and disaster recovery; systems operations; network security and monitoring; training; application security; physical security; customer data privacy; vendor management; risk assessment; incident response; and vulnerability management.
  • Obtain annual approval of the policies by a senior officer or the board, and record the date.
  • Separate policies from procedures, with procedures approved by the program lead.
  • Create an exception process with written, time-limited, approved exceptions and a register.
  • Version-control every policy so the version in force on any date can be produced.
  • Retain policies and program documentation for at least six years (HIPAA requires six years from creation or last effective date).
  • Reconcile public statements with the policies and correct any statement the company cannot substantiate.
  • For operators of child-directed services, adopt the written children's information security program the amended COPPA Rule requires.

Part 5: Core technical controls

Identity and access

  • Require multi-factor authentication for every individual accessing any information system, including employees, contractors, and vendors.
    • 16 C.F.R. § 314.4(c)(5); 23 NYCRR § 500.12 (universal MFA since November 1, 2025). Exceptions require written approval by the Qualified Individual or CISO.
  • Use phishing-resistant MFA (hardware keys or platform authenticators) for administrators, cloud consoles, and remote access to sensitive data.
  • Offer MFA to customers on any consumer account that exposes personal or financial information.
  • Enforce least privilege with role-based access, and review access at least annually (more often for privileged accounts).
  • Deploy privileged access management and block commonly used passwords (required for Part 500 Class A companies).
  • Remove access promptly on termination or role change, and audit that it happened.
  • Harden the help desk: verify identity before password or MFA resets using a method an attacker cannot easily spoof.

Data protection

  • Encrypt customer and other sensitive information at rest and in transit over external networks.
    • 16 C.F.R. § 314.4(c)(3); 23 NYCRR § 500.15. Compensating controls require written approval and, under Part 500, annual review.
  • Manage encryption keys separately from the data they protect.
  • Adopt a retention schedule and dispose of customer information no later than two years after its last use unless a business need or law requires retention.
    • 16 C.F.R. § 314.4(c)(6); 23 NYCRR § 500.13(b).
  • Destroy consumer report information securely.
  • Operate an identity theft prevention program if the company is a "creditor" with covered accounts.

Infrastructure, monitoring, and resilience

  • Maintain the asset inventory and update it on a fixed schedule (23 NYCRR § 500.13(a); 16 C.F.R. § 314.4(c)(2)).
  • Deploy endpoint detection and response with 24-hour alert monitoring (required for Part 500 Class A companies; expected by most insurers).
  • Centralize logs, retain them long enough to investigate a months-old intrusion, and review alerts.
    • 16 C.F.R. § 314.4(c)(8) requires monitoring and logging of authorized users' activity.
  • Patch on defined timelines by severity, prioritizing internet-facing systems and vulnerabilities known to be exploited.
  • Segment networks so that a compromised workstation cannot reach regulated data stores.
  • Keep offline or immutable backups and test restoration at least annually.
  • Adopt secure development practices for in-house applications and a process to evaluate externally developed applications (16 C.F.R. § 314.4(c)(4); 23 NYCRR § 500.8).
  • Scan code repositories for secrets and block credentials from being committed.
  • Adopt change management procedures (16 C.F.R. § 314.4(c)(7)).
  • Secure email: sender authentication (SPF, DKIM, DMARC), attachment and link filtering, and external-sender warnings.

Part 6: Vendor and third-party oversight

  • Inventory every vendor with access to regulated data, network access, or operational importance.
  • Tier vendors by data sensitivity and business impact.
  • Perform diligence proportionate to tier and read, do not just file, SOC 2 Type II reports, including exceptions and complementary user-entity controls.
  • Require safeguards by contract (16 C.F.R. § 314.4(f)(2)), including MFA, encryption, logging, and subcontractor flow-down.
  • Require incident notice within a fixed number of hours that is shorter than your own regulatory clocks.
    • Regulation S-P requires policies under which service providers notify the firm within 72 hours, 17 C.F.R. Part 248; Part 500 requires notice terms in vendor contracts.
  • Obtain cooperation, audit, and forensic-access rights, and data return or deletion at termination.
  • Review limitation-of-liability, indemnity, and insurance terms with breach costs in mind.
  • Execute business associate agreements with every HIPAA business associate, and confirm subcontractor agreements downstream.
  • Reassess critical vendors at least annually (16 C.F.R. § 314.4(f)(3)).
  • Plan for vendor failure in business continuity planning, including concentration risk.
  • Offboard vendors with access revocation and certified data deletion.

Part 7: Training, testing, and remediation

  • Train all personnel at least annually, including social engineering (23 NYCRR § 500.14(a)(3); 16 C.F.R. § 314.4(e)(1)).
  • Run role-based training for finance (payment fraud), help desk (identity verification), developers (secure coding and secrets), and administrators.
  • Run phishing simulations and follow up with targeted training.
  • Brief directors and senior executives annually on threats and their incident roles.
  • Commission an annual external penetration test scoped to the crown jewels.
    • Required under Part 500 (from inside and outside the network) and, absent continuous monitoring, under 16 C.F.R. § 314.4(d)(2)(i).
  • Run vulnerability assessments at least every six months and after material changes, absent continuous monitoring (16 C.F.R. § 314.4(d)(2)(ii)).
  • Commission independent audits of the program if a Part 500 Class A company.
  • Track every finding to closure with severity-based deadlines, or document an extension or acceptance.
  • Run an annual tabletop exercise that tests both incident response and business continuity, with senior officers and the highest-ranking executive participating (required by Part 500).
  • Write after-action reports and track the improvements like audit findings.

Part 8: Incident response and reporting clocks

  • Adopt a written incident response plan covering goals, processes, roles and decision authority, communications, remediation, documentation, and post-incident review.
  • Adopt a business continuity and disaster recovery plan with protected backups (23 NYCRR § 500.16).
  • Build a clock map listing every applicable trigger, deadline, recipient, and decision-maker:
    • NYDFS: 72 hours after determining a cybersecurity incident occurred at the entity, an affiliate, or a vendor; 24 hours after any extortion payment, with a written explanation within 30 days.
    • SEC: Form 8-K Item 1.05 within four business days after determining an incident is material, with the determination made without unreasonable delay. 17 C.F.R. § 249.308.
    • FTC Safeguards Rule: as soon as possible and within 30 days after discovering a notification event involving 500 or more consumers. 16 C.F.R. § 314.4(j).
    • Banks: 36 hours to the primary federal regulator after determining a notification incident. 12 C.F.R. Part 53.
    • Credit unions: 72 hours to the NCUA. 12 C.F.R. Part 748.
    • Defense contractors: 72 hours to DoD, with images preserved for 90 days. DFARS 252.204-7012.
    • HIPAA: individuals within 60 days of discovery, HHS at the same time for breaches of 500 or more.
    • FTC Health Breach Notification Rule: individuals within 60 days, FTC at the same time for 500 or more. 16 C.F.R. Part 318.
    • Regulation S-P: affected individuals within 30 days.
    • Carriers: FCC, FBI, and Secret Service within seven business days. 47 C.F.R. § 64.2011.
    • Insurance licensees in NAIC model law states: commissioner within 72 hours.
    • CIRCIA: confirm whether CISA's final rule has taken effect; if so, 72 hours for covered incidents and 24 hours for ransom payments.
    • State breach statutes, contracts, and insurance policies: as applicable.
  • Name a decision-maker and a backup for each trigger, and require timestamped written determinations.
  • Pre-approve the materiality process for public companies: disclosure committee membership, escalation thresholds, factors, template Item 1.05 and Item 8.01 language, and trading-window procedures.
  • Adopt a ransom protocol: legal review, sanctions screening, insurer consent, law enforcement contact, approval authority, and documentation.
  • Pre-negotiate engagement letters under which outside counsel retains the forensic firm for legal advice, separate from routine security services.
  • Pre-draft notice templates for regulators, individuals, customers, and the insurer.
  • Maintain an incident log that records every security event, its classification, and the reason it did or did not trigger a notice.

Part 9: Regime-specific items

FTC Act and the GLBA Safeguards Rule

  • Substantiate every public security claim with evidence before it is published.
  • Confirm the program meets every element of 16 C.F.R. § 314.4 under the statutory objectives of 15 U.S.C. § 6801(b).
  • If relying on the small-institution exception (fewer than 5,000 consumers), document the count; the exception covers only the written risk assessment, continuous monitoring or penetration testing, the written incident response plan, and the board report (16 C.F.R. § 314.6).
  • Confirm the Qualified Individual's annual written report covers program status, compliance, and the material matters listed in § 314.4(i).
  • Prepare to file an FTC notice within 30 days of discovering a notification event; assign who files and who approves.
  • Review the FTC's recent security orders (Drizly, Chegg, Blackbaud, Marriott, GoDaddy) as a gap list; each lists the controls the FTC found missing.

NYDFS Part 500

  • Determine status: Class A company, limited exemption, or standard covered entity, using the revenue, employee, and asset thresholds (counting affiliates as the regulation requires).
  • Confirm the CISO's annual written report to the senior governing body, and timely reporting of material issues.
  • Confirm the board's oversight provisions are met and minuted.
  • File by April 15 either the certification of material compliance or the acknowledgment of noncompliance, signed by the highest-ranking executive and the CISO.
  • Keep the records that support the certification available for examination.
  • Class A companies: confirm independent audits, privileged access management, password blocking, endpoint detection and response, and centralized logging and alerting.
  • Confirm portal access for more than one person, so a 72-hour notice can be filed when the CISO is unavailable.

SEC: public companies and registered firms

  • Draft the 10-K Item 106 disclosure from documented facts about risk management, third-party oversight, board oversight, and management's expertise. 17 C.F.R. § 229.106.
  • Reconcile risk factors with known incidents; never describe a materialized risk as hypothetical.
  • Test disclosure controls to confirm that security incidents reach the disclosure committee. Exchange Act Rule 13a-15, 17 C.F.R. Part 240; 15 U.S.C. § 7241.
  • Use Item 8.01 for voluntary disclosure of incidents not determined to be material, and Item 1.05 only after a materiality determination.
  • Broker-dealers, advisers, funds, and transfer agents: confirm the Regulation S-P incident response program, 30-day customer notice process, and service provider oversight are in place (compliance dates passed in December 2025 for larger entities and June 2026 for smaller ones).
  • SCI entities: confirm Regulation SCI policies and SCI event notification procedures. 17 C.F.R. Part 242.

HIPAA and health data

  • Confirm status as a covered entity or business associate under 45 C.F.R. § 160.103.
  • Document a decision for every addressable specification: implemented, or an equivalent alternative with the reason.
  • Review information system activity records regularly and document the reviews.
  • Monitor the status of HHS's January 2025 proposed Security Rule overhaul and plan for its requirements (asset inventory and network map, MFA, encryption, scanning, penetration testing, 72-hour restoration).
  • For health apps outside HIPAA, confirm whether the FTC Health Breach Notification Rule applies, including to unauthorized disclosures to advertising platforms.

Defense contractors

  • Identify every contract containing FAR 52.204-21 or DFARS 252.204-7012, -7019, -7020, or -7021. 48 C.F.R. Part 52; 48 C.F.R. Part 252.
  • Maintain a current system security plan and a NIST SP 800-171 assessment score posted where DoD requires it.
  • Determine the required CMMC level for each contract and the assessment type, and plan for third-party certification as the phased rollout expands. 32 C.F.R. Part 170.
  • Have a senior official affirm compliance annually only after reviewing evidence; close any plan-of-action items within the allowed period.
  • Flow down requirements to subcontractors that handle covered information.
  • Treat every certification as a potential False Claims Act statement. 31 U.S.C. § 3729. See False Claims Act Compliance and Defense Checklist: A Practical Checklist.

State law

  • Massachusetts: confirm the WISP includes every 201 CMR 17.03 element and the 17.04 computer system requirements, including encryption of personal information on laptops and portable devices and in transmission over public networks.
  • New York: confirm reasonable administrative, technical, and physical safeguards under N.Y. Gen. Bus. Law § 899-bb, or document the GLBA, HIPAA, or Part 500 compliance that deems the business compliant.
  • California: confirm "reasonable security procedures and practices" under Cal. Civ. Code § 1798.81.5, and assess exposure to statutory damages under § 1798.150.
  • California cybersecurity audits: determine whether the California Privacy Protection Agency's audit regulations apply and calendar the first audit certification deadline, which is phased by revenue.
  • Safe-harbor states (Ohio, Utah, Connecticut, Iowa, and others): document the program's conformity to a recognized framework.
  • Comprehensive privacy law states: confirm the "reasonable data security" duties in each applicable statute.

Insurance, telecommunications, and critical infrastructure

  • Insurance licensees in NAIC model law states: information security program, board oversight, vendor oversight, incident response plan, annual certification to the commissioner by February 15, and 72-hour notice.
  • Telecommunications carriers: CPNI safeguards and customer authentication, the annual CPNI compliance certification, and the expanded breach rule. 47 U.S.C. § 222.
  • Bulk electric system entities: NERC CIP compliance program and evidence. 18 C.F.R. Part 40.
  • Pipelines and rail: current TSA security directives and any final TSA rule; a named cybersecurity coordinator.
  • All critical infrastructure sectors: monitor CIRCIA's final rule and update the clock map when it takes effect.

Part 10: Board reporting, certifications, and disclosures

  • Deliver the annual written report from the program lead to the board or committee.
  • Include metrics: MFA coverage, patch latency, open findings by age, phishing results, incidents, vendor risk, and the top risks with trends.
  • Record in the minutes who presented, what materials were provided, what directors asked, and what they directed.
  • Hold an executive session with the program lead at least annually.
  • Approve resources or record the reasons for declining requests.
  • Calendar every certification (NYDFS, NAIC, CPNI, CMMC affirmations, SOX certifications) with an owner and a review step.
  • Review cyber insurance applications for accuracy before signing; misstatements can void coverage. See D&O and Cyber Insurance Review Checklist.

Part 11: Examination and investigation readiness

  • Maintain an indexed evidence file that maps each likely request to a document and its location.
  • Designate a single point of contact for regulators, and a backup.
  • Keep a litigation hold procedure that reaches chat, ticketing, and cloud logs. See Litigation Hold and Evidence Preservation Checklist: A Practical Checklist.
  • Adopt a privilege protocol for investigations, and seek a Fed. R. Evid. 502(d) order when producing documents in litigation.
  • Close prior examination findings and keep proof of closure.
  • Prepare the program lead to explain the program and its history as a witness.
  • Never create documents after a request and present them as earlier records.

Part 12: Annual compliance calendar

When Task
January Confirm regime applicability; refresh the asset inventory; plan the year's testing
By February 15 NAIC model law certifications (insurance licensees)
By March 1 CPNI compliance certification (carriers)
Q1 (calendar-year filers) Item 106 disclosure in the 10-K
By April 15 NYDFS certification or acknowledgment of noncompliance
Each quarter Board or committee update; privileged access reviews; vendor monitoring
Every six months Vulnerability assessments (absent continuous monitoring)
Annually Risk assessment update; policy approval; penetration test; training; tabletop exercise; written board report; critical vendor reassessments; backup restoration test
On any trigger Reassess risk after acquisitions, major system changes, significant incidents, or new rules

Common mistakes this checklist is designed to catch

  • Treating the GLBA as a banking statute and missing that the business is a "financial institution."
  • A risk assessment that skips SaaS tools, cloud accounts, or acquired subsidiaries.
  • MFA exceptions that were never approved in writing or reviewed.
  • A clock map that omits affiliate and vendor incidents, or contract deadlines shorter than any regulator's.
  • An NYDFS certification of compliance signed while remediation was still open.
  • Vendor files containing SOC 2 reports no one read.
  • Board "reporting" that left no trace in the minutes.

Frequently asked questions

How long does it take to complete this checklist the first time? For a mid-size company with a partial program, expect several months for the initial pass, because many items require work rather than verification. Later passes are faster.

Who should sign off on the completed checklist? The program lead should certify the status of each item, counsel should review the regulatory items, and the summary should go to the board committee with the annual report.

What if an item conflicts with another rule, such as a retention requirement? Follow the more specific legal requirement and document the conflict and the resolution. The Safeguards Rule's disposal provision, for example, expressly allows retention that another law requires.

Is this checklist enough for an acquisition target? It is a strong starting point for diligence, but add questions about prior incidents, pending investigations, undisclosed breaches, and representations in the purchase agreement.

Practical takeaways

  • Start with applicability; every later item depends on knowing which rules apply.
  • Treat every "not applicable" as a decision that needs a written reason.
  • The controls that matter most are MFA, patching, backups, logging, segmentation, and vendor terms.
  • Map every reporting clock in advance and name the person who decides.
  • Certify only what is complete, and keep the evidence that proves it.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Companion documents in this series

Related Articles and Guides

Related Checklists

Related Toolkits