US state GRC
State privacy and security rules, mapped next to the federal ones.
Lavawall® includes state compliance packs for New York, New Jersey, Illinois, California, Texas, and Pennsylvania. Each pack covers general privacy, insurance, finance, health, transportation, and public sector requirements, and links to the same shared controls that carry your SOC 2, HIPAA, and NIST work. It covers over 120 frameworks, with a CISSP/CISA audit team behind it.
What each state pack covers
Each pack has a state framework with tiers by sector, so a clinic, a credit union, an insurer, a fleet operator, and a county office each see the requirements that apply to them. The largest rules also stand alone, so an examiner or a customer who names one can be answered by name.
- New York: the SHIELD Act, with the state requirements for insurance, finance, health, transportation, and public sector. NYDFS Part 500 is available as its own framework.
- New Jersey: the New Jersey Data Privacy Act, Daniel’s Law, and the state sector requirements.
- Illinois: the Biometric Information Privacy Act (BIPA), and the state requirements for general privacy, insurance, finance, health, transportation, and public sector.
- California: the California Privacy Protection Agency regulations on risk assessments, cybersecurity audits, and automated decision-making, next to CCPA/CPRA and the state sector requirements.
- Texas: the Texas Data Privacy and Security Act, the Texas Responsible AI Governance Act, and the state sector requirements.
- Pennsylvania: the Breach of Personal Information Notification Act, and the state sector requirements, including insurance data security.
Where the state adds rules for federal-funded programs, such as Medicaid, benefits, or criminal justice data, the pack has a tier for those too. See the full list on the compliance frameworks page.
What you get for each state
A pack is more than a list of laws. These pieces are included.
Questionnaires
An assessment for each sector tier and for the largest rules, with every question tied to a control, so answers count toward every framework that shares it.
Templates
State-specific notices and procedures, such as breach notification, where the state has its own form or recipient.
Staff training
A privacy and security course for the state, and short modules for health, finance and insurance, public sector, and transportation, each with a quiz and a pass mark.
AI use, covered by existing law
How each state’s existing rules apply when staff use AI tools with personal information, so the policy and the training say the same thing.
The wizard finds them
Choose your states and sectors in the Compliance Wizard and the matching frameworks are recommended, with the reason for each.
Honest about what is unsettled
State privacy law is changing quickly. Dates not yet in force and points not confirmed from the official text are labelled as such, not smoothed over.
General information, not legal advice
The state packs and courses are general information for compliance work. They are built from the official statutes and regulator publications, and they do not replace advice from counsel on your own facts.
Frequently asked
- Which US states does Lavawall cover?
- New York, New Jersey, Illinois, California, Texas, and Pennsylvania, each as a state compliance pack alongside federal frameworks such as HIPAA, GLBA, PCI DSS, and NIST. Each state has one framework with tiers for general privacy, insurance, finance, health, transportation, and public sector, and standalone frameworks for the largest rules, such as the New York SHIELD Act, Illinois BIPA, and the Texas Data Privacy and Security Act.
- Is this legal advice?
- No. The packs and courses are general information for compliance work. Each is built from the official statute and regulator text, and anything that is not yet in force, or that could not be confirmed from the official source, is marked as such in the content. Check with counsel for your own situation.
- Does it include training for staff?
- Yes. Each state has a privacy and security course written to that state’s law, plus shorter modules for health, finance and insurance, public sector, and transportation. The Training Program wizard offers them when you choose the state as a region.
- Do I need a separate tool for state rules?
- No. State requirements map to the same shared control set as the federal and global frameworks, so evidence collected once counts everywhere it applies.