NYDFS Cyber for Financial Orgs

Cybersecurity Regulations & Financial Institutions

NOTE: This article discusses legal issues and regulations. It does not constitute legal advice and is provided for informational purposes only. TEKRiSQ has excellent legal colleagues we can refer you to if you’d like to explore these issues further.

Data breaches in every industry that are associated with hacking, malware, and social engineering have been skyrocketing.  As a response to increasing cyber risks, in March 2017, the New York Department of Financial Services (NYDFS) instituted 23 NYCRR 500. This is a cybersecurity regulation that businesses operating in the State of New York must take seriously. Significant fines to businesses ignoring this are well reported. See More…

What Does It Require?

NYDFS cyber obligations impact both large enterprise and SMBs in FinancialServices. NYDFS establishes minimum security requirements to protect financial institutions (and their customers) from cyberattacks. The regulation impacts anyone “operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law.”

Who is Impacted?

This means the vast majority of banks, insurance companies, and financial institutions in New York will be held accountable by the regulation. It also applies to third-parties (located outside of New York) that provide services to these institutions as well as other organizations who, while not based in New York, are doing financial business in the state. These include many licensees.

Why is this so Brutal?

NYDFS 500 cyber obligations for Large Enterprises and SMBs in  Financial Services are deliberately serious. NYCRR 500 is described as the “harshest” and “strictest” of cybersecurity regulations. According to the New York Law Journal, this regulation “marks a watershed moment in cybersecurity regulation in the United States. For the first time, a single state is regulating cybersecurity on a potentially global scale, and it has done so via the regulatory process, not legislative action.”

So, Here’s What you Must Do

There are four phases of the regulation.

1. Phase 1, which went into effect August 28, 2017 requires firms to: establish a formal cybersecurity program, appoint a Chief Security Officer, regularly review user access privileges, hire cybersecurity personnel, and develop a written incident response plan.
2. Phase 2, which went into effect March 1, 2018, requires financial services organizations to: regularly perform penetration testing and vulnerability assessments, conduct a risk assessment of information systems, use multi-factor or risk-based authentication, conduct regular cybersecurity awareness training, and produce an annual report on their cybersecurity program and any risks.
3. Phase 3, which went into effect September 3, 2018, requires firms to: maintain records and audit trails, establish and follow guidelines for application security, limit data retention and establish proper procedures for safe data disposal, monitor and detect unauthorized access of sensitive information, and encrypt nonpublic data in motion and at rest.
4. The final phase went into effect March 1, 2019, requires firms to: be in compliance with 23 NYCRR 500 and also obligates their third-party service providers to comply.

TEKRiSQ offers the tools for NYDFS Compliance. We make it fast, easy and affordable. Learn More…