Source: Cybersecurity Resource Center | Department of Financial Services (ny.gov)
The NYDFS Cybersecurity Regulation (23 NYCRR 500) represents a comprehensive framework established by the New York Department of Financial Services (NYDFS) to impose cybersecurity standards on all covered financial entities. Introduced on February 16th, 2017, following extensive feedback from industry stakeholders and the public, these regulations encompass 23 sections delineating the obligations for developing and executing an effective cybersecurity program. Covered institutions are mandated to assess their cybersecurity risks and devise proactive strategies to mitigate them. The regulation follows a phased implementation approach, allowing organizations ample time to fortify their policies and controls.
Covered Entities:
The NYDFS Cybersecurity Regulation applies to entities operating under DFS licensure, registration, or charter, or those otherwise regulated by DFS. Additionally, it extends to unregulated third-party service providers engaged with regulated entities. Notable examples of covered entities include state-chartered banks, licensed lenders, insurance companies, and service providers. Certain exemptions are granted to organizations with fewer than 10 employees, generating less than $5 million in gross annual revenue from New York operations over the past three years, or holding less than $10 million in year-end total assets.
Operational Framework:
The regulation enforces stringent cybersecurity protocols on covered entities, necessitating the formulation of a detailed cybersecurity plan, appointment of a Chief Information Security Officer (CISO), establishment of comprehensive cybersecurity policies, and implementation of an ongoing reporting mechanism for cybersecurity incidents. These components encompass various sub-regulations and requirements, aligning with the NIST Cybersecurity Framework.
Key Requirements:
A compliant cybersecurity program under the NYDFS Cybersecurity Regulation adheres to several pivotal requirements, including:
- Identification of internal and external cybersecurity threats.
- Deployment of defensive infrastructure to counteract threats.
- Implementation of a detection system for cybersecurity events.
- Prompt response to detected cybersecurity incidents.
- Implementation of measures to recover from cybersecurity events.
- Fulfillment of regulatory reporting obligations.
Compliance Phases:
The phased implementation of the NYDFS Cybersecurity Regulation commenced on February 15, 2018, necessitating covered organizations to develop a cybersecurity policy inclusive of an incident response plan within 72 hours of data breach discovery. Subsequent phases require the preparation of an annual report by CISOs, establishment of a comprehensive cybersecurity program encompassing various elements such as audit trails and encryption measures, and finalization of policies concerning third-party security.
Consequences and Penalties:
While specific details regarding fines for non-compliance remain undisclosed, violations of the regulation will incur penalties, the magnitude of which is yet to be determined. Covered entities are urged to ensure compliance with the regulation's provisions to mitigate the risk of penalties.
Best Practices for Compliance:
To achieve compliance with the NYDFS Cybersecurity Regulation, financial institutions should proactively assess their covered status, assemble a dedicated regulatory compliance team, understand their risk profile through ongoing assessments, and adhere to all regulatory deadlines diligently.
Additional Training Resources:
To help regulated entities plan for compliance, the Department has developed Part 500 training resources:
Download the Cybersecurity Regulation Training Presentation (PDF)
Watch the Cybersecurity Regulation Training Presentation (Video)
Download the Requirement Checklist (for Regulated Entities with Limited Exemptions) (PDF)
View the 'Am I Exempt from DFS's Cybersecurity Regulation?' Flowchart (PDF)
To learn more Contact us