en en id en en en en en en en en en en en en en en en en en en en en en en en en en en en ko en ko ko ko ko en en en en en en en en en en en en en en en en en en es en en en en en en en en en en en en en en en en en en en en
Compliance With New York’s Cybersecurity Regulation 23 NYCRR Part 500 | Data Privacy + Cybersecurity Insider
Leveraging Knowledge to Manage Your Data Risks
By Carrie Turner on December 6, 2017
Posted in Cybersecurity, Data Privacy, Data Security, Enforcement + Litigation, State Laws Relating to Data
On March 1, 2017, New York’s Cybersecurity Regulation (23 NYCRR Part 500)[1] became effective.  The regulation is the first of its kind in the nation and requires certain companies, including banks, insurance companies and other financial services institutions regulated by the Department of Financial Services (“Covered Entities”), to have:
a cybersecurity program designed to protect consumers’ private data;
a written policy or policies that are approved by the Board of Directors or a senior officer;
a Chief Information Security Officer to help protect data and systems; and
in place controls and plans to help ensure the safety and soundness of New York’s financial services industry.[2]
In addition, pursuant to the regulation, Covered Entities must report a cybersecurity event if (a) the event impacts the Covered Entity and notice of it is required to be provided to any government body, self-regulatory agency or any other supervisory body; or (b) the event has a reasonable likelihood of materially harming any material part of the normal operation(s) of the Covered Entity.  Details regarding what makes up such an event are detailed on the New York Department of Financial Services website.[3]
Covered Entities were required to be in compliance by August 28, 2017, unless otherwise specified. By February 15, 2018, Covered Entities are required to submit an annual certification attesting that they have complied with the regulation.[4]
While the regulation does not specify who must sign the annual certification, the form appended to the regulation requires either the “Board of Directors” (rather than merely one Director) or “Senior Officer(s)” to sign. The signer must have reviewed documents, reports, certifications and opinions of officers, representatives, outside vendors and other individuals as necessary.  Problematically, if the Covered Entity elects that the Board of Directors sign the annual certification, the certification process would likely become very time-consuming for the Board.[5]  On the other hand, the regulation’s definition of “Senior Officer” states that the individual(s) must be “responsible for management, operations, security information, systems, compliance and/or risk of the company,” indicating that, particularly in larger institutions, numerous Senior Officers may be required to sign.[6]
Pursuant to the regulation, insurance companies, agencies, brokerages and producers doing business in New York – even those who qualify for a limited exemption – are required to create and maintain cybersecurity programs to protect the confidentiality and integrity of their information systems.
Insurers are likely to face several issues. First, compliance with the regulation will require resources “that may need to be diverted from core business activities, plus expertise that not all organization possess.”[7]  Due to a shortage of cybersecurity expertise, insurers will likely be required to pay significant sums in order to retain the necessary cybersecurity experts needed to meet the regulation’s requirements.[8]  According to some reports, total Chief Information Security Officer compensation at large firms may exceed $1 million.[9]  Furthermore, the regulation places a heavy reporting requirement on insurers that will likely be costly with regard to ensuring that the companies maintain up-to-date technology and employee training.[10]  If the insurance company chooses to outsource elements of the cybersecurity assessment, monitoring and other activities required pursuant to the regulation, the Covered Entity still remains responsible for security and compliance.[11]
New York’s cybersecurity regulation is seen as providing a model for other jurisdictions in the future.
[1] New York State Department of Financial Services 23 NYCRR 50, available at http://dfs.ny.gov/legal/regulations/adoptions/dfsrf500txt.pdf (last viewed on Dec. 5, 2017).
[2] Department of Financial Services, Press Release: DFS Cybersecurity Regulation Compliance Requirements are Effective Today, Aug. 28, 2017, available at www.dfs.ny.gov/about/press/pr1708281.htm (last viewed on Dec. 5, 2017).
[3] Department of Financial Services, Frequently Asked Questions Regarding 23 NYCRR Part 500, available at http://www.dfs.ny.gov/about/cybersecurity_faqs.htm (last viewed on Dec. 5, 2017).
[4] A list of additional deadlines by which Covered Entities must be in compliance with various sections of the regulation can be found at  http://www.dfs.ny.gov/about/cybersecurity.htm (last viewed on Dec. 5, 2017).
[5] Kade N. Olsen and Craig A. Newman, DFS Cyber Regulation Countdown: Who Should Certify Compliance?, Patterson Belknap Data Security Law Blog, Aug. 14, 2017, available at https://www.pbwt.com/data-security-law-blog/dfs-cyber-regulation-countdown-who-should-certify-compliance (last viewed on Dec. 5, 2017).
[7] Anthony Ferrante and Jim Wrynn, What Insurance Companies Need to Know about Part 500 Cybersecurity Compliance, Insurance Journal, October 17, 2017, available at https://www.insurancejournal.com/news/east/2017/10/10/466958.htm (last viewed on Dec. 5, 2017).
Tags: annual certification, Board of Directors, Chief Information Security Officer, Covered Entities, cybersecurity program, Department of Financial Services, New York Cybersecurity Regulation
Email this postTweet this postLike this postShare this post on LinkedIn
Carrie Turner is a member of Robinson+Cole’s Insurance + Reinsurance Group, where she focuses her practice on breach of contract, first- and third-party insurance coverage disputes, coverage analysis, cyber liability, property damage claims, environmental and contamination loss, breach of fiduciary duty, bad faith…
Carrie Turner is a member of Robinson+Cole’s Insurance + Reinsurance Group, where she focuses her practice on breach of contract, first- and third-party insurance coverage disputes, coverage analysis, cyber liability, property damage claims, environmental and contamination loss, breach of fiduciary duty, bad faith, and other extracontractual claims litigation.
Prior to joining Robinson+Cole, Ms. Turner clerked for the Honorable Boyce F. Martin, Jr. on the United States Court of Appeals for the Sixth Circuit. Ms. Turner has experience litigating and advising insurers and reinsurers on a broad range of coverage issues, including litigation arising from 9/11. She has litigated from inception to settlement numerous Superstorm Sandy claims regarding flood exclusion issues. Her additional litigation experience includes general commercial, corporate and partnership disputes, attorney malpractice, and a broad range of contract disputes at both the trial and appellate levels. She has authored appellate briefs in various state and federal courts.
Read Carrie’s rc.com bio.
Read more about Carrie Turner
Show more Show less
Federal Privacy Law – Could It Happen in 2019?
The FCC Wants You to Delete TikTok
If Your Disclosure of a Data Breach Was  “Late,” You May Have to Litigate
Follow us on Twitter Follow us on Twitter
Follow Us on Facebook Follow Us on Facebook
View Our Linkedin Profile View Our Linkedin Profile
Data Privacy + Cybersecurity Insider
Follow us on Twitter Follow Us on Facebook View Our Linkedin Profile RSS
Robinson+Cole is a law firm serving regional, national and global clients from nine offices throughout the Northeast. Our Data Privacy + Security Team brings together lawyers from the firm’s Intellectual Property and Technology, Commercial Litigation, and E-Commerce Groups.
Topics Select Category Artificial Intelligence Autonomous Machines Autonomous Systems Autonomous Vehicles Blockchain Cannabis CCPA Children’s Privacy Coronavirus Cybersecurity Data Breach Data Privacy Data Security Digital Assets Drone Privacy Drones e-Discovery Enforcement + Litigation Events Geolocation Guest Posts Health Information Privacy HIPAA and Health Information Information Governance Insurance Coverage International Privacy Laws Internet of Things Mergers & Acquisitions New + Now Privacy Tips Public-Private Partnerships with Cyber Security Safe Harbor Social Media State Laws Relating to Data Telehealth Telephone Consumer Protection Act Uncategorized Virtual Currency Websites
Archives Select Month September 2022 August 2022 July 2022 June 2022 May 2022 April 2022 March 2022 February 2022 January 2022 December 2021 November 2021 October 2021 September 2021 August 2021 July 2021 June 2021 May 2021 April 2021 March 2021 February 2021 January 2021 December 2020 November 2020 October 2020 September 2020 August 2020 July 2020 June 2020 May 2020 April 2020 March 2020 February 2020 January 2020 December 2019 November 2019 October 2019 September 2019 August 2019 July 2019 June 2019 May 2019 April 2019 March 2019 February 2019 January 2019 December 2018 November 2018 October 2018 September 2018 August 2018 July 2018 June 2018 May 2018 April 2018 March 2018 February 2018 January 2018 December 2017 November 2017 October 2017 September 2017 August 2017 July 2017 June 2017 May 2017 April 2017 March 2017 February 2017 January 2017 December 2016 November 2016 October 2016 September 2016 August 2016 July 2016 June 2016 May 2016 April 2016 March 2016 February 2016 January 2016 December 2015 November 2015 October 2015 September 2015 August 2015 July 2015 June 2015 May 2015 April 2015 March 2015