A deadline for implementing changes to New York cybersecurity regulations is quickly approaching. The New York Department of Financial Services (DFS) recently enforced significant revisions to the regulations on November 1, impacting not only New York State companies but also their affiliates. This could have far-reaching effects beyond the state borders.
The amended regulation, known as “Part 500,” aims to enhance cybersecurity preparedness, response, and governance in New York’s financial services sector. It includes requirements such as maintaining a cybersecurity program, designating a Chief Information Security Officer, implementing a written cybersecurity policy, conducting vulnerability assessments, and more.
Some highlights of the changes include stepped-up requirements for larger companies, expanded breach notification requirements, reporting ransomware payments, and narrowing small business exceptions. DFS has also expanded its enforcement powers, potentially leading to significant penalties for violations.
Katherine Lemire and Laura Ferguson, experts in government enforcement and financial services regulatory matters, emphasize the importance of businesses reviewing these amendments as other regulators may follow suit in the future.