A deadline for implementing changes to New York cybersecurity regulations is fast approaching. As of November 1, significant revisions to the regulations enforced by the New York Department of Financial Services (DFS) have come into effect. These changes not only impact New York State companies but also their affiliates, potentially extending their reach beyond state borders.
The amended regulation, known as “Part 500,” aims to enhance cybersecurity preparedness, response, and governance in New York’s financial services sector. It establishes various requirements for Covered Entities, including the maintenance of a cybersecurity program, designation of a Chief Information Security Officer, implementation of a cybersecurity policy, vulnerability assessments, multi-factor authentication, mandatory breach reporting, and employee training.
Some highlights of the changes include stepped-up requirements for larger companies, expanded breach notification requirements, reporting of ransomware payments, and narrowing of small business exceptions. Additionally, the revisions grant DFS expanded enforcement powers, potentially leading to significant penalties for violations.
These regulations impact a wide range of industries, including insurance, banking, and crypto. Businesses are advised to review these amendments as other regulators may follow suit in the future.