An important deadline under the New York State Department of Financial Services' (“DFS”) Cybersecurity Regulation is fast approaching.  DFS' cybersecurity regulation, contained in 23 NYCRR Part 500, went into effect on March 1, 2017 (the “regulation” or “cybersecurity regulation”).  The regulation established cybersecurity requirements for entities licensed by DFS, including banking organizations, insurance companies and money transmitters.

The cybersecurity regulation established several transitional periods to allow covered entities time to comply with certain stipulated requirements including deadlines in August 2017, February 2018 and March 2018.  The current transitional period, which concludes on Sept. 4, requires covered entities to comply with additional regulatory requirements, including an audit trail, limitations on data retention, encryption of certain nonpublic information, application security and training and monitoring.

Audit Trail

Beginning Sept. 4, DFS-regulated entities covered by the cybersecurity regulation will be required to securely maintain systems that have audit trail capabilities.  Specifically, the systems must be designed to reconstruct material financial transactions sufficient to support the normal operations and obligations of the covered entity.  23 NYCRR § 500.06(a)(1).  These systems must also include audit trails designed to detect and respond to cybersecurity events that have a reasonable likelihood of materially harming any “material part of the normal operations of the Covered Entity.”  23 NYCRR § 500.06(a)(2).  The regulation defines “cybersecurity events” as any act or attempt, successful or unsuccessful, to gain unauthorized access to, disrupt, or misuse an information system or information stored on such information systems.  23 NYCRR § 500.01(d).

Additionally, each covered entity must maintain books and records for a specified period of time, the length of which depends on the type of information retained.  For audit trails designed to detect and respond to cybersecurity events, the covered entity must maintain records for at least three years.  23 NYCRR § 500.06(b).  Likewise, for systems necessary to reconstruct material financial transactions sufficient to support normal operations and obligations, the covered entity must maintain such records for at least five years.  23 NYCRR § 500.06(b).

In short, covered entities must now have systems in place that can re-create certain financial transactions and detect and respond to cybersecurity attacks.  The books and records provision is not a new regulatory requirement, as many DFS-regulated entities have historically been required to maintain comprehensive books and records.  See generally New York Insurance Law § 325; 11 NYCRR § 243; New York Banking Law §§ 200-c and 672.

Limitations on Data Retention

While the cybersecurity regulation requires the maintenance of audit trails and books and records, it also provides limitations on data retention, including for the secure disposal of certain sensitive information possessed or handled by covered entities.  For example, covered entities must adopt and implement policies and procedures for the secure disposal of “nonpublic information” that is “no longer necessary for business operations or for other legitimate business purposes.”  23 NYCRR § 500.13.  The disposal of this information must occur on a “periodic basis,” the exact frequency of which the regulation does not define.

Moreover, there are exceptions to this disposal requirement, including where such nonpublic information is otherwise legally required to be retained and where disposal of such information is not reasonably feasible based on the manner in which the information is maintained.

It is worth noting that the regulation's limitations on data retention apply to nonpublic information that is either personal in nature (e.g., Social Security numbers, drivers' license numbers, etc.) or healthcare-related.  See 23 NYCRR §§ 500.13 and 500.01(g)(2)-(3).

 Encryption of Nonpublic Information

In addition, covered entities must implement certain internal controls to safeguard the nonpublic information that they hold and transmit.  23 NYCRR § 500.15(a).  The regulation provides for “encryption” as an appropriate control but notes that to the extent it is not feasible to use encryption to transmit nonpublic information over external networks, the covered entity can use alternative methods for ensuring secure transmission.  23 NYCRR § 500.15(a)(1).  Likewise, to the extent it is not feasible to encrypt nonpublic information possessed internally, covered entities can utilize alternative safeguard controls as well.  The regulation, however, does not specify the exact alternative controls that are permissible.

If a covered entity ultimately decides to use alternative controls, then such controls must be reviewed at least annually by the chief information security officer (CISO) whom the covered entity should have already appointed pursuant to 23 NYCRR § 500.04.  See 23 NYCRR § 500.15(a)(2).

Application Security

Covered entities will also be required to adopt and implement written “procedures, guidelines and standards” to ensure secure development practices for the use of applications that are designed in-house and implement procedures for evaluating, assessing, or testing the security of externally-developed technology applications.  23 NYCRR § 500.08(a).

Additionally, the CISO must periodically review, assess and update the covered entities' application procedures, guidelines, and standards.  The regulation does not provide guidance as to how frequently such reviews must occur, only noting that these reviews must occur “as necessary.”  23 NYCRR § 500.08(b).

Training and Monitoring

Starting March 1, covered entities were required to provide regular cybersecurity training to personnel.  23 NYCRR § 500.14(b).  After Sept. 4, covered entities will be further required to implement policies, procedures and controls for monitoring the activity of certain personnel with access to information systems, including employees, contractors, agents or other persons who participate in the covered entities' business operations and use the covered entities' information systems and data.  23 NYCRR §§ 500.01(b) and 500.14(a).  Such policies, procedures and controls must also be designed to detect unauthorized access, use of, or tampering with nonpublic information.

Thus, entities subject to the cybersecurity regulation must not only monitor employee system activity, they must also have controls in place to detect improper activity on the part of contractors and agents, which can often pose challenges to regulated entities.

Conclusion

In short, the transitional period that concludes on Sept. 4 poses additional requirements that DFS-regulated entities subject to the cybersecurity regulation must implement and abide by.  Prior to the Sept. 4 deadline, covered entities should undertake a comprehensive review of their cybersecurity programs to ensure there are no compliance gaps.  Given DFS' history of pursuing enforcement actions for inadequate internal controls, covered entities should take extra precautions to ensure the adequacy of their internal policies, procedures and guidelines.

Andrew Jacobson is an associate at Seward & Kissel and a member of the firm's government enforcement and internal investigations practice group. He is a former enforcement attorney with the New York State Department of Financial Services.