New York-based finance firms must now have cybersecurity policy
Banks, insurance companies and other financial institutions in New York state now have to comply with pioneering cybersecurity regulations, which took effect on 28 August. The laws, which are the first of their kind in the country, require firms covered by the New York Department of Financial Services (DFS) to have a board-approved, written cybersecurity policy or policies and a chief information security officer in place. In addition, companies must submit an annual Certification of Compliance, with the first due in February 2018. The DFS also requires companies to submit details of cybersecurity events within 72 hours of them happening.

New York State’s “first-in-the-nation” cybersecurity regulation became effective on August 28, 2017.

The New York Department of Financial Services (“DFS”) cybersecurity regulation requires banks, insurance companies and other institutions regulated by the DFS (“covered entities”) to implement a cybersecurity program to protect consumer data (see previous coverage). A covered entity is required to have (i) a written cybersecurity policy or policies approved by the entity’s board of directors or a senior officer, (ii) a “Chief Information Security Officer” in place to protect data and systems, and (iii) other relevant “controls and plans” intended to fortify the safety of the financial services industry.

Firms also will be required to submit a Certification of Compliance annually that concerns the firm’s cybersecurity compliance program. The first such Certificate must be submitted by February 15, 2018. The DFS now requires covered entities to submit notices of certain cybersecurity events to the DFS Superintendent within 72 hours of any occurrence. Covered entities will be able to report cybersecurity events through the DFS online cybersecurity portal. Institutions also will be able to use the portal to file notices of exemption.

DFS Superintendent Maria Vullo commented on the program: