The deadline for implementing changes to New York cybersecurity regulations is quickly approaching. As of November 1, significant revisions to the regulations enforced by the New York Department of Financial Services (DFS) have come into effect. These changes not only impact New York State companies but also their affiliates, potentially extending their reach beyond state borders.
DFS amended its cybersecurity regulations in November 2023, affecting various New York State-regulated financial services companies, including insurers, crypto exchanges, and fintech companies. The revised regulation, known as “Part 500,” aims to enhance cybersecurity preparedness, response, and governance within the financial services sector. Part 500 establishes requirements for Covered Entities, such as maintaining a cybersecurity program, designating a Chief Information Security Officer, implementing a cybersecurity policy, conducting vulnerability assessments, and providing employee training.
Some highlights of the changes to the DFS cybersecurity regulations include stepped-up requirements for larger companies, expanded breach notification requirements, reporting ransomware payments, and narrowing small business exceptions. Additionally, the revisions grant DFS expanded enforcement powers, potentially leading to significant penalties for violations.
The amendments have implications for a wide range of industries, including insurance, banking, and crypto. Businesses are advised to review these changes as other regulators may follow suit in the future.
Katherine Lemire, a partner at Quinn Emanuel Urquhart & Sullivan, and Laura Ferguson, an associate at the same firm, specialize in government enforcement and financial services regulatory matters.