An important deadline under the New York State Department of Financial Services' (DFS) Cybersecurity Regulation is fast approaching. DFS's Cybersecurity Regulation, contained in 23 NYCRR Part 500, went into effect on March 1, 2017 (the Regulation or Cybersecurity Regulation). The Regulation established cybersecurity requirements for entities licensed by DFS, including banking organizations, insurance companies, and money transmitters.

The first major compliance deadline was Aug. 28, 2017. Entities covered by the Regulation were required, among other things, to: (1) have written cybersecurity policies and procedures approved by the board of directors or a senior officer; (2) appoint a Chief Information Security Officer (CISO); and (3) implement certain controls and plans to protect the safety and soundness of the covered entity's operations, by that date.

The August deadline also triggered a requirement that covered entities report certain cybersecurity events to DFS in a timely manner. Specifically, covered entities must notify DFS “as promptly as possible” but no later than 72 hours after determining that a cybersecurity event has occurred. This notice requirement is triggered for cybersecurity events that either: (1) impact the covered entity in such a way that notice must be provided to any other governmental, self-regulatory, or supervisory body; or (2) have a reasonable likelihood of materially harming any “material” part of the covered entity's normal operations. 23 NYCRR §500.17(a).

The second major deadline is Feb. 15, 2018 and requires that all covered entities file their first annual certification of compliance with DFS by that date. The certification of compliance is significant, in part, because it requires the covered entity's board of directors (or an applicable senior corporate officer) to certify the adequacy of the entity's cybersecurity compliance program. Specifically, each covered entity must submit a written statement to DFS certifying that the entity was in compliance with the requirements set forth in the Regulation for the preceding calendar year. 23 NYCRR §500.17(b).

Given DFS's historical emphasis on individual accountability at its regulated entities, preparing for this compliance certification is critical.

Responsibility of Senior Management

The annual certification requirement confers direct responsibility on a covered entity's board of directors or an applicable senior officer (e.g., someone responsible for the management, operations, security, information systems, compliance, and/or risk of the entity) to certify various aspects of the entity's cybersecurity program. The Regulation's Appendix A provides a form certification that must be submitted as part of the annual certification. See 23 NYCRR Part 500, Appendix A. This form expressly provides for a senior officer or board of directors to certify two areas of compliance.

First, an applicable senior officer or the board of directors must attest that, to the best of their knowledge, the entity's cybersecurity program complied with the Regulation for the preceding year. 23 NYCRR Part 500, Appendix A. Second, the applicable senior officer or board of directors must certify that they have “reviewed documents, reports, certifications and opinions of such officers, employees, representatives, outside vendors and other individuals or entities as necessary.” Id.

While the Regulation emphasizes general cybersecurity preparedness and real-time reporting, it is clear that senior management's involvement is also a top priority for DFS. The Regulation's preamble expressly mandates that senior management of covered entities take cybersecurity “seriously,” and ultimately holds them “responsible for the organization's cybersecurity program.” 23 NYCRR §500.00. Further, while the CISO will naturally bear the brunt of this burden, it is important to note that the Regulation contemplates an even broader involvement of senior management, including the board of directors.

In this sense, DFS seeks to hold individual corporate leaders responsible for ensuring compliance with the Regulation. This concept of holding individuals accountable within large companies is not new for this regulator, as DFS has repeatedly held individual employees accountable for corporate misconduct in the past. See, e.g., Consent Order, In the Matter of Deutsche Bank AG, Deutsche Bank AG New York Branch, New York State Department of Financial Services (Nov. 3, 2015) (ordering the termination of certain employees involved in the alleged misconduct, among other discipline); Consent Order, In the Matter of Bank of Tokyo-Mitsubishi UFJ, Ltd. New York Branch, New York State Department of Financial Services (Nov. 18, 2014) (ordering individual employees disciplined and banned from conducting business with DFS-regulated financial institutions).

Renewal of Examination Priorities

In addition to the upcoming annual compliance certification and heightened accountability for senior management, DFS is planning to revise its examination priorities in an effort to strengthen its cybersecurity oversight. In January 2018, DFS announced that it would incorporate cybersecurity into all examinations of covered entities. DFS also explained that it will include cybersecurity components in its “first day letters,” which are notices that DFS issues to regulated entities when commencing examinations.

While it is not clear exactly what cybersecurity questions will be raised during examinations, regulated entities should prepare to engage DFS examiners on topics relating to their policies and procedures, systems, and precautions undertaken to detect and protect from cyber risks. Further, as detailed above, certain members of senior management should be knowledgeable about, and prepared to discuss, the company's cybersecurity efforts.

Records Retention

Finally, each covered entity is required to maintain certain records for DFS examination, which conceivably could (and likely will) be used by DFS examiners to verify the entity's annual compliance certifications. The Regulation requires each covered entity to maintain for DFS examination all “records, schedules and data” supporting the annual compliance certification for a period of five years. 23 NYCRR §500.17.

Further, to the extent a covered entity has identified cybersecurity-related areas, systems, or processes that require “material improvement, updating or redesign,” the covered entity must document such areas and any related remedial efforts. Id. In light of this requirement, covered entities should carefully and diligently document their cybersecurity efforts, including the policies, procedures, and systems underlying those initiatives.

Conclusion

In short, DFS-regulated entities that are subject to the Cybersecurity Regulation should make every effort to prepare their annual certifications in a timely manner, with knowledge that DFS will likely seek records and other documents during examinations to verify the adequacy of the entities' cybersecurity programs. Further, relevant members of senior management should take an active role in overseeing the entity's cybersecurity efforts, as DFS's continued focus on senior management accountability will likely increase in the future.

Michael Considine is a partner at Seward & Kissel and co-head of the firm's government enforcement and internal investigations practice group. Andrew Jacobson is an associate at the firm and a former enforcement attorney with the New York State Department of Financial Services.