Navigating the New NYDFS Cybersecurity Regulations: What Businesses Need to Know

As the digital landscape continues to evolve, so do the threats that financial institutions and other regulated entities face. In response to these challenges, the New York Department of Financial Services (NYDFS) has enacted comprehensive cybersecurity regulations aimed at safeguarding sensitive information and ensuring robust cybersecurity practices. With new amendments set to take effect on November 1, 2024, it is crucial for covered entities—including financial institutions, insurance companies, and other businesses regulated by the NYDFS—to prepare for compliance.

Quick Hits

The amended NYDFS cybersecurity regulations will introduce several new requirements effective November 1, 2024. Covered entities must update their policies and procedures in key areas such as corporate governance, encryption, incident response, business continuity plans, system testing, and employee training.

A Brief History of NYDFS Cybersecurity Regulations

The NYDFS first enacted its cybersecurity regulations on March 1, 2017, establishing a framework for financial services companies to protect consumer data and mitigate cybersecurity risks. The regulations were recently amended on November 1, 2023, with a series of rolling effective dates. While some provisions will come into effect as early as December 1, 2023, others will follow, with significant changes slated for November 1, 2024, and additional requirements in 2025.

Who is Affected?

The cybersecurity regulations apply to a broad range of covered entities regulated by the NYDFS. This includes:

• Financial institutions
• Insurance companies
• Insurance agents and brokers
• Banks and trusts
• Mortgage banks, brokers, and lenders
• Money transmitters and check cashers

Under the amended regulations, larger companies (referred to as Class A companies) will face additional requirements, while certain small businesses may qualify for exemptions from specific regulations.

Key Regulations Effective November 1, 2024

For nonexempt covered entities, including Class A companies, several critical steps should be taken to ensure compliance by November 1, 2024. Here are some key areas to focus on:

1. Corporate Governance

Covered entities must enhance their corporate governance structures. This includes ensuring that the Chief Information Security Officer (CISO) reports timely to the senior governing body or senior officers on material cybersecurity issues. Regular oversight of cybersecurity risk management is essential, and the governing body must have a sufficient understanding of cybersecurity matters to effectively oversee these risks.

2. Encryption Policies

Entities must implement a written policy that mandates encryption to protect nonpublic information, adhering to industry standards. If encryption is not feasible for information at rest, alternative compensating controls may be used, provided they receive written approval from the CISO.

3. Incident Response Plans

Updating incident response plans is crucial. These plans should outline the internal processes for responding to cybersecurity events, including recovery from backups and conducting root cause analyses post-incident.

4. Business Continuity and Disaster Recovery

A comprehensive business continuity and disaster recovery plan must be established, ensuring that necessary backups are maintained to restore material operations in the event of a disruption.

5. Employee Training

Training is a vital component of cybersecurity preparedness. Employees responsible for implementing incident response and disaster recovery plans must be adequately trained regarding their roles and responsibilities.

6. Regular Testing

Covered entities are required to test their incident response plans, disaster recovery plans, and backup systems at least annually to ensure effectiveness and readiness.

Reviewing Exemptions and Requirements

Covered entities should carefully review the amended cybersecurity regulations to determine if they qualify for any exemptions. Additionally, a thorough understanding of the complete list of applicable cybersecurity requirements, including those effective November 1, 2024, is essential for compliance.

Next Steps for Compliance

As the deadline approaches, companies regulated by the NYDFS should conduct a comprehensive review of their cybersecurity policies, practices, and training programs. Ensuring compliance with the amended regulations by November 1, 2024, is critical. Furthermore, businesses should prepare for additional requirements that will take effect on May 1, 2025, and November 1, 2025.

Conclusion

The evolving landscape of cybersecurity regulations necessitates proactive measures from covered entities regulated by the NYDFS. By understanding the new requirements and taking the necessary steps to comply, businesses can better protect themselves and their customers from the growing threat of cyberattacks. As we move toward November 2024, the time to act is now—ensuring that robust cybersecurity practices are not just a regulatory obligation, but a cornerstone of business integrity and consumer trust.