NYDFS Cybersecurity Regulation Explained

Each Covered Entity must implement and maintain written policies that address the following areas:

• Information security
• Data governance and classification
• Asset inventory and device management
• Access controls and identity management
• Business continuity and disaster recovery planning and resources
• Systems operations and availability concerns
• Systems and network security
• Systems and network monitoring
• Systems and application development and quality assurance
• Physical security and environmental controls
• Customer data privacy
• Vendor and Third Party Service Provider management
• Risk assessment
• Incident response

A Chief Information Security Officer (CISO) must be designated to enforce each Covered Entity’s cybersecurity program and policies. The CISO can be employed by the Covered Entity, one of its Affiliates, or a Third Party Service Provider.

The cybersecurity program for each Covered Entity should include monitoring and testing, developed in accordance with the Covered Entity’s Risk Assessment, designed to assess the effectiveness of the Covered Entity’s cybersecurity program. This includes:

• Annual penetration testing
• Bi-annual vulnerability assessments

Each Covered Entity must securely maintain systems that, to the extent applicable and based on its Risk Assessment are designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the Covered Entity and include audit trails.

Covered Entities should limit user access privileges to Information Systems that provide access to Nonpublic Information. These access privileges should be periodically reviewed.

Cybersecurity programs must include written procedures, guidelines and standards designed to ensure the safety of internally and externally developed applications. These procedures should be reviewed and updated periodically.

Periodic documented Risk Assessments should be conducted to update and revise existing policies to account for evolving threats.

In addition to the CISO, each Covered Entity will employ qualified cybersescurity personnel (via Covered Entity, an Affiliate or a Third Party Service) to manage cybersecurity risks and oversee the Cybersecurity Program. Covered Entities must:

• Provide cybersecurity personnel with cybersecurity updates and training sufficient to address relevant cybersecurity risks
• Verify that key cybersecurity personnel take steps to maintain current knowledge of changing cybersecurity threats and countermeasures

Covered Entities must implement written policies and procedures designed to ensure the security of Information Systems and Nonpublic Information that are accessible by Third Party Service Providers.  These policies must address:

• Identification and risk assessment of Third Party Service Providers
• Minimum cybersecurity practices required to be met by such Third Party Service Providers in order for them to do business with the Covered Entity
• Due diligence processes used to evaluate the adequacy of cybersecurity practices of such Third Party Service Providers
• Periodic assessment Third Party Service Providers based on the risk they present and the continued adequacy of their cybersecurity practices

Based on its Risk Assessment, each Covered Entity will use effective controls, which may include Multi-Factor Authentication or Risk-Based Authentication, to protect against unauthorized access to Nonpublic Information or Information Systems. Multi-Factor Authentication should be used by any individual accessing the Covered Entity’s internal networks from an external network, unless the Covered Entity’s CISO has approved in writing the use of reasonably equivalent or more secure access controls.

As part of its cybersecurity program, each Covered Entity shall include policies and procedures for the secure disposal on a periodic basis of any Nonpublic Information that is no longer necessary for business operations.

Each cybersecurity program should:

• Implement risk-based policies, procedures and controls designed to monitor the activity of Authorized Users and detect unauthorized access or use of, or tampering with, Nonpublic Information by such Authorized Users
• Provide regular cybersecurity awareness training for all personnel

As part of its cybersecurity program, based on its Risk Assessment, each Covered Entity must implement controls, including encryption, to protect Nonpublic Information held or transmitted by the Covered Entity both in transit over external networks and at rest.

Each Covered Entity must establish a written incident response plan designed to promptly respond to, and recover from, any Cybersecurity Event. It should address:

• Internal processes for responding to a Cybersecurity Event
• Goals of the incident response plan
• Definition of clear roles, responsibilities and levels of decision-making authority
• External and internal communications and information sharing
• Identification of requirements for the remediation of any identified weaknesses in Information Systems and associated controls
• Documentation and reporting regarding Cybersecurity Events and related incident response activities
• Evaluation and revision as necessary of the incident response plan following a Cybersecurity Event

Covered Entities must notify the NYDFS superintendent within 72 hours after noticing a Cybersecurity Event that has a reasonable likelihood of materially harming any material part the Covered Entity’s IT infrastructure. An annual compliance statement covering the previous calendar year must be submitted by February 15^th. Each Covered Entity should maintain all records, schedules, and data supporting this certificate for a period of five years.