While the New York Cybersecurity Regulations represent a softening in key respects from the requirements set forth in the initial proposal, the regulations impose minimum standards that exceed existing federal standards and introduce new requirements, including obligations to critically evaluate cybersecurity practices to ensure compliance, maintain detailed documentation demonstrating compliance and report cyber events to the New York Department of Financial Services.

Overview

On March 1, 2017, the New York Department of Financial Services’ (DFS) Cybersecurity Regulations (the Regulations) entered into effect. [1] Under the Regulations, any individual or non-governmental partnership, corporation, branch, agency, association or other entity operating under a license, registration, charter, certificate, permit, accreditation or similar authorization under New York banking, insurance or financial services laws (with narrow exceptions described below) (Covered Entities) is required to formally assess its cybersecurity risks and establish and maintain a cybersecurity program designed to address such risks in a “robust” fashion.

(more…)