New York state has adopted a cybersecurity regulation that officials say will protect New York’s financial services industry and consumers from the threat of cyber attacks. It took effect March 1.
The regulation requires banks, insurance companies and other financial services institutions regulated by the Department of Financial Services to establish and maintain a cybersecurity program designed to protect consumers’ private data and ensure the safety and soundness of New York’s financial services industry.
“New York is the financial capital of the world, and it is critical that we do everything in our power to protect consumers and our financial system from the ever increasing threat of cyber-attacks,” Gov. Andrew Cuomo said.
He said the protections “will help ensure this industry has the necessary safeguards in place in order to protect themselves and the New Yorkers they serve from the serious economic harm caused by these devastating cyber-crimes.”
State Department of Financial Services Superintendent Maria T. Vullo said the regulation “is ensuring that New York consumers can trust that their financial institutions have protocols in place to protect the security and privacy of their sensitive personal information. As our global financial network becomes even more interconnected and entities around the world increasingly suffer information breaches, New York is leading the charge to combat the ever-increasing risk of cyber-attacks.”
The regulation includes certain regulatory minimum standards while encouraging firms to keep pace with technological advances. Officials said it provides important protections to prevent and avoid cyber breaches, including:
• Controls relating to the governance framework for a robust cybersecurity program including requirements for a program that is adequately funded and staffed, overseen by qualified management, and reported on periodically to the most senior governing body of the organization.
• Risk-based minimum standards for technology systems including access controls, data protection including encryption, and penetration testing.
• Required minimum standards to help address any cyber breaches including an incident response plan, preservation of data to respond to such breaches, and notice to DFS of material events.
• Accountability by requiring identification and documentation of material deficiencies, remediation plans and annual certifications of regulatory compliance to DFS.
Richard Clarke, chairman and CEO, Good Harbor Consulting LLC and member of the governor’s Cyber Security Advisory Board, said the regulation shows that the state “recognizes how critical it is to safeguard the financial services industry from the ever-growing threat of cyber-attacks. With this regulation, DFS is leading the nation in promulgating strong minimum standards to protect regulated entities and the consumers they serve.”
DFS considered comments submitted during a 45-day period following the publication of the proposed regulation in September and a 30-day period following the publication of the updated proposed regulation in December. Suggestions that DFS deemed appropriate were incorporated in the final regulation, officials said.