New York cyber reporting law alert! In a major shift that sets the tone for national cybersecurity policy, New York State has passed legislation requiring all local governments and public authorities to report cyberattacks within 72 hours and disclose ransomware payments within just 24 hours. This groundbreaking law—signed by Governor Kathy Hochul on June 26, 2025—represents a growing recognition of the urgent need for cyber transparency, resilience, and coordinated response.

Why This Law Matters

Cyberattacks against municipalities have surged in recent years, often exploiting weak infrastructure, outdated systems, and underfunded security programs. With local governments controlling critical infrastructure—from public schools and utilities to transit and healthcare systems—the risk of disruption has never been greater.

By mandating strict disclosure timelines, New York is effectively forcing a culture shift in how organizations prepare for, detect, and recover from attacks. In particular, this law shines a spotlight on ransomware—a tactic that continues to dominate headlines and cost millions in recovery and downtime.

What Organizations Need to Do

If your business or partners work with or alongside public agencies in New York, this law may affect your operations directly or indirectly. Organizations should:

• Ensure cyber incidents are identified and escalated within hours—not days.
• Have clearly documented disaster recovery and incident response plans.
• Prepare executives and legal teams to handle ransomware payment disclosures within 24 hours.
• Deploy advanced detection systems such as endpoint protection and network monitoring.
• Regularly test and update policies with simulated tabletop exercises.

Implications Beyond Public Sector

While the law targets public entities, it sets a precedent that private businesses would be wise to follow voluntarily. Regulatory bodies at the federal level are likely to mirror these expectations in future legislation. Cyber insurance underwriters may also start to weigh reporting preparedness more heavily in risk models.

From a supply chain perspective, failure to rapidly disclose or respond to a breach could impact vendor relationships, insurance coverage, and customer trust. Organizations of all sizes should view this law as a benchmark—not a boundary.

How Cost+ Helps You Stay Compliant and Resilient

At Cost+, we support businesses in building strong cyber foundations through a layered and affordable approach. Our Recovery+, Security+, and Compliance+ services are designed to help you prevent attacks, prepare for the worst, and respond with confidence if an incident occurs.

We also offer free assessments, including:

• Free Security Check
• Cost Check+ to help you evaluate and streamline your IT expenses

Final Thoughts

New York’s new cyber reporting law isn’t just about compliance—it’s about preparedness. In a world where ransomware groups move faster than legislation, every hour counts. The organizations that succeed won’t be the ones who scramble after an incident—they’ll be the ones who plan before it happens.

Now is the time to align your security posture with tomorrow’s regulations—before they become mandates.

Cost+ is local to New York City and we’re happy to stop by in person to help with all aspects of IT. From support to cyber security. Offices located in New Jersey, Florida and Arizona. To schedule a consultation or learn more, contact Cost+ today.

By Thomas McDonald
Vice President

The rise of generative AI in the workplace is transforming productivity—but it’s also quietly introducing serious compliance risks. From finance and healthcare to legal and insurance, employees across industries are increasingly turning to tools like ChatGPT, Copilot, and Bard without proper oversight. When these tools are used to process sensitive data, the consequences can be far-reaching, particularly for organizations subject to regulatory frameworks like HIPAA, GDPR, GLBA, and SOX.

How Generative AI Is Slipping Through the Cracks

Many employees see AI tools as convenient assistants: summarizing documents, answering emails, generating reports. But in the rush to embrace efficiency, few stop to consider whether using these tools aligns with corporate data policies or regulatory obligations.

Consider these increasingly common scenarios:

• A legal assistant pastes a confidential case summary into an AI tool to draft a client letter.
• A healthcare provider uses an AI chatbot to rewrite a patient care note.
• A financial analyst uploads internal spreadsheets into Copilot to generate forecasts.

In each case, data that may be regulated, proprietary, or subject to audit trails is being transmitted to third-party systems—without proper logging, encryption controls, or clear knowledge of where it’s stored or who has access.

This is not just a data governance issue; it’s a compliance landmine. If your organization is audited and cannot account for where sensitive information went, the liability may be significant—even if there was no malicious intent.

Regulatory Consequences Are Catching Up

Until recently, regulators had not directly addressed generative AI usage. That’s changing. Authorities are beginning to scrutinize how AI tools process sensitive data, whether companies have visibility into their usage, and whether sufficient safeguards are in place.

For example, in the U.S., the Federal Trade Commission (FTC) announced enforcement actions against companies misrepresenting AI capabilities and misusing consumer data. The initiative, called Operation AI Comply, signals that regulators are paying close attention to how AI is deployed—and how it impacts compliance with privacy and security laws.

Internationally, the European Union’s GDPR requires that data processors disclose automated decision-making practices, retain auditability, and obtain proper consent—criteria that many AI tools struggle to meet when used informally within companies. HIPAA-regulated entities, meanwhile, are prohibited from disclosing protected health information (PHI) to third parties unless under strict business associate agreements—something most AI vendors do not offer by default.

The regulatory environment is evolving quickly, and non-compliance—intentional or not—can lead to fines, sanctions, or reputational damage.

What Business Leaders Can Do Now

Compliance is not about halting innovation—it’s about guiding it. To responsibly embrace AI in the workplace, organizations need to implement clear guardrails and visibility mechanisms. Here are immediate steps to consider:

• Create an Acceptable Use Policy for AI Tools: Define which tools are approved, how they can be used, and what data types are prohibited from being input.
• Educate Employees: Ensure staff understand the risks of pasting sensitive data into AI platforms. Training should cover regulatory exposure and corporate policies.
• Implement Monitoring Solutions: Use endpoint protection, DLP (data loss prevention), or firewall controls to detect unauthorized AI traffic or data exfiltration.
• Work With Legal and Compliance Teams: Before adopting new AI platforms, conduct thorough risk assessments and ensure alignment with internal controls and applicable laws.
• Review Vendor Agreements: If employees are using AI tools that store or process company data, you must review the tool’s data handling, retention, and sharing practices.

Importantly, organizations should not rely solely on user discretion. Even well-intentioned employees can create compliance issues if they don’t understand the implications of using unsanctioned tools.

Looking Ahead

AI is here to stay—but blind adoption is not sustainable. Compliance frameworks are evolving, and enforcement actions will likely target companies that failed to take proactive steps. The time to put controls in place is before a breach, not after.

Executives, IT leaders, and compliance officers should treat uncontrolled AI usage as they would any other systemic risk: monitor it, educate stakeholders, and take decisive steps to mitigate exposure. Doing nothing is not a neutral position—it’s a liability.

Schedule a Free Compliance Review

If your organization is unsure how to govern employee use of AI tools, Cost+ offers Compliance+ services to help. We can assess your current policies, review your tech stack, and recommend the safeguards needed to protect your business. Schedule a free consultation today.

A risk assessment is one of the most requested documents in a regulatory review—but most organizations get it wrong. The issue isn’t that businesses fail to perform them, but that the assessments don’t hold up under scrutiny. Regulators want to see structured analysis, not vague summaries or recycled templates. Weak assessments often lack a defined methodology, fail to rank risks by severity and likelihood, omit ownership of mitigation tasks, or leave out timelines for review and updates. These aren’t minor details—they’re central to determining whether an organization understands its risk posture and is actively managing it.

The Stakes Are Higher Than They Appear
A risk assessment is not just a compliance artifact—it’s a proxy for how a company governs itself. If regulators see a document that’s inconsistent, outdated, or disconnected from actual operations, they infer the same about the organization’s broader security and compliance program. That judgment can shape the outcome of an audit, influence enforcement decisions, and erode credibility in legal disputes or insurance claims.

What Reviewers Are Really Looking For
Ultimately, regulators care less about the format of the assessment and more about what it reveals: how the business prioritizes threats, incident response, assigns responsibility, tracks improvement, and adapts to changes in systems or laws. An assessment that demonstrates thoughtful analysis and a living process stands out—and signals a culture of accountability rather than box-checking.

Schedule Your Free Consultation Today
Want to strengthen your risk documentation before the next audit? Schedule a free consultation with our Compliance+ team.

A data breach is no longer a question of if—it’s when. And when it happens, regulators will ask one question first: Did you follow your incident response plan?

Policy Alone Isn’t Enough
Having a document labeled “Incident Response Plan” isn’t the same as having a functional one. Regulators and auditors want to see evidence that the plan is current, realistic, and actively used. That includes clearly defined roles for key personnel, steps for detecting and containing threats, communication protocols for notifying stakeholders, legal and regulatory reporting guidelines, and procedures for documenting post-incident lessons learned. These elements aren’t optional—they’re expected. And if they aren’t present, organizations risk penalties, reputational damage, and insurance complications.

Common Points of Failure
In many businesses, response plans are incomplete, untested, or unknown to employees. The most common weaknesses include relying on outdated contact information, omitting third-party roles, overlooking internal communication strategies, and failing to document recovery actions. These oversights lead to confusion when speed and clarity matter most.

Planning Is Prevention
An incident response plan isn’t just a checkbox—it’s the operational playbook when systems go offline, data is compromised, or ransomware locks down a network. A strong plan reflects the actual structure of the business, considers the full lifecycle of an event, and is reviewed regularly—not just after something goes wrong.

Schedule Your Free Consultation Today
Want to make sure your response plan stands up to scrutiny? Schedule a free consultation with our Compliance+ team.

For many companies, cybersecurity policies exist in name only—buried in a shared drive, drafted years ago, and forgotten. But regulators, insurers, and legal teams now treat written policies as evidence of an organization’s intent, preparation, and governance. In short, you can no longer operate in confidence without a written security policy.

What Regulators Expect to See
A written policy doesn’t guarantee security, but it establishes expectations—and creates accountability. When businesses lack formal documentation, investigators often assume the controls don’t exist. During audits or after a breach, regulators typically request copies of core documents like an information security policy, acceptable use policy, data retention schedule, vendor risk protocol, and an incident response plan. Without them, businesses may be considered out of compliance even if protective measures are in place.

Policy Gaps Lead to Broader Risk
The most common issue is not the absence of security itself, but the inability to prove it. Many organizations have good technical defenses, but fail to document how decisions are made, how risks are evaluated, and how staff are expected to respond. These gaps weaken positions during legal reviews, complicate insurance claims, and increase the likelihood of regulatory penalties.

Good Policy Is Practical, Not Aspirational
Effective policies are realistic, concise, and enforced. They reflect how the business actually operates—not an idealized version of it. This includes identifying who is responsible for updates, setting review timelines, training staff on the contents, and aligning language with existing procedures and controls. A strong security posture isn’t just built on tools—it’s supported by policies that can be shown, explained, and defended.

Schedule Your Free Consultation Today
Want help evaluating your existing security policies? Schedule a free consultation with our Compliance+ team.