New York Cybersecurity Requirements for Financial Services Companies

WWW.CITRINCOOPERMAN.COM WWW.WWMLAWYERS.COM
NY Cybersecurity Requirements for
Financial Services Companies

TODAY’S PRESENTERS
David Rosenbaum
Principal
Citrin Cooperman & Company LLP
drosenbaum@citrincooperman.com
914-693-7000
Jeremy Kerman, Esq.
Attorney
Walker Wilcox Matousek LLP
jkerman@wwmlawyers.com
312-244-6700
Celeste King, Esq.
Founding Partner
Walker Wilcox Matousek LLP
cking@wwmlawyers.com
312-244-6700

WHAT REGULATION?
New York State
Department of Financial Services
23 NYCRR 500

WHAT IS CYBERSECURITY?
Computers
• Desktops
• Laptops
• Tablets
• Phones
Networks
• Servers
• Firewalls
• Peripheral
devices
• Internet of
Things (IoT)
Data (at rest)
• On file servers
• On computer
hard drives
• On backup or
removable
media
• In the Cloud
Data (in
motion)
• Email
• Web, portals
• Networks, Wi-
Fi
• Faxes
• Phones

WHAT ARE THE OBJECTIVES
OF CYBERSECURITY?
• Data Confidentiality
• Data Integrity
• Data Availability

WHY DOES NEW YORK STATE CARE?
• Ever-growing cyber threat
• Privacy of NY consumers’ data
• Financial risk to covered entities
• Financial services industry is a significant target

THE BIG 3 QUESTIONS?
1. Do the new regulations affect me?
2. How do I comply with the new regulations?
3. What happens if I do not comply?

DO THE NEW REGULATIONS AFFECT ME?
Regulations govern businesses governed by NYDFS - this includes:
• Banks and Trust Companies
• Budget Planners
• Charitable Foundations
• Credit Unions
• Insurance Companies (health, life, P&C)
• Holding Companies
• Investment Companies
• Mortgage Bankers and Brokers
• “Third-Party Service Providers” of any of the above businesses

Partial exemptions for companies:
• <10 employees
• <$5M gross annual revenue in each of last 3 years
• <$10M in year-end total assets
• No non-public information
 Note: What if you go from exempt to non-exempt?
DO THE NEW REGULATIONS AFFECT ME?

HOW DO I COMPLY WITH
THE NEW REGULATION?
Two broad requirements:
1. Self-Risk Profile Assessment
2. Design and Implementation of Cybersecurity Program
&

Reporting Requirements:
• Annual certification confirming compliance
• Report any act or attempt, successful or unsuccessful
• 72 hours to report cybersecurity event if:
• Notice is required for any other agency or gov’t body, or
• Event has a “reasonable likelihood” of materially harming
any material part of normal operations
THE NEW REGULATION?

• Identify and assess both internal and external risks
• Defensive infrastructure, policies, and procedures to:
• Protect nonpublic information
• Deal with any cybersecurity event
• Have a written, easily revisable policy, to protect information
• Approved by security officer or Board,
• Addresses all aspects of cybersecurity
• Unique to your business
THE NEW REGULATION?
Risk Assessment:

Multi-Factor Authentication and Encryption:
• Multi-factor authentication strongly encouraged in general
• Must be used for anyone externally accessing internal network
• Periodically and securely dispose of data
• Encrypt nonpublic information, whether at rest or transmitted
THE NEW REGULATION?

Cybersecurity Personnel, Penetration Testing, and Audit Trail:
• Designate CISO
• Do penetration monitoring and testing
• Audit trail limit user access appropriately
• Written procedures for evaluating and testing security of externally developed
apps
• Qualified cybersecurity personnel to manage risks, and provide updates and
training to other personnel
THE NEW REGULATION?

THIRD-PARTY SERVICE PROVIDERS
• Written policies and procedures that ensure that all data you protect or
hold is kept secure
• Maintain minimum standards
• Periodically update risk assessment for the third-party
• Provide guidelines for access controls, use of encryption and notice of
any cybersecurity event

A NOTE ABOUT INSURANCE
• Cyber/data privacy insurance
• Directors & Officers Insurance – failure to develop proper procedures or
report on time?
• Errors and omissions – failure to develop an adequate response plan,
failure to properly train, failure to develop procedures?

WHAT HAPPENS IF I DON’T COMPLY?
• Not much guidance on enforcement
• “The regulation will be enforced by the superintendent pursuant to, and
is not intended to limit, the superintendent’s authority under any
applicable laws”

WHAT DO I DO NOW?
• Determine if you are eligible for a limited exemption
• File Notices of Exemption no later than 9/27/2017
• Self-assess your compliance status
• Unless already in compliance –
• Undertake a formal gap assessment
• Remediate compliance gaps
• File annual attestations
• Adhere to your policies and procedures
• Repeat

23 NYCRR 500 CRITICAL DATES
March 1, 2017
Effective Date - NYS Cybersecurity Regulations became effective (23 NYCRR Part
500)
August 28, 2017
Deadline for Compliance - Covered Entities are required to be in compliance with
the requirements of 23 NYCRR Part 500, unless otherwise specified
September 27,
2017
Deadline for Exemption Notice – Covered Entities that qualify for a limited
exemption must file a Notice of Exemption by this date.
February 15, 2018
Deadline for 1st Annual Certification Submission – Covered Entities are required to
file their 1st Certification of Compliance by this date.
March 1, 2018
1 Year Transitional Period Ends – Covered Entities are required to be in compliance
with the requirements of section 500.04(b), 500.05, 500.09, 500.12, and 500.14(b)
of 23 NYCRR Part 500 (see regulations document for details of the sections above)
September 3, 2018
18 Month Transitional Period Ends - Covered Entities are required to be in
compliance with the requirements of section 500.06, 500.08, 500.13, 500.14(a), and
500.15 of 23 NYCRR Part 500 (see regulations document for details of the sections
above)
February 15, 2019
Deadline for 2nd Annual Certification Submission– Covered Entities are required to
file their 2nd Certification of Compliance by this date.
March 1, 2019
Deadline for Full Compliance for All – Covered Entities are required to be fully
compliant with the requirements of 23 NYCRR Part 500

 www.dfs.ny.gov/legal/regulations/adoptions/dfsrf500txt.pdf
 www.dfs.ny.gov/about/whowesupervise.htm
 trac@citrincooperman.com for our Self-Assessment Tool
NYS DFS RESOURCES

QUESTIONS?

New York Cybersecurity Requirements for Financial Services Companies

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to New York Cybersecurity Requirements for Financial Services Companies

Similar to New York Cybersecurity Requirements for Financial Services Companies (20)

More from Citrin Cooperman

More from Citrin Cooperman (20)

Recently uploaded

Recently uploaded (20)

New York Cybersecurity Requirements for Financial Services Companies