A deadline for implementing changes to New York cybersecurity regulations is just around the corner. On November 1, significant revisions to the regs enforced by the New York Department of Financial Services (DFS)—the state's financial services regulator—went into effect. The DFS revisions create a long-arm provision in that the changes affect not only New York State companies, but also their affiliates, and therefore the revisions could have an impact far beyond New York State borders.

DFS amended its cybersecurity regulations in November 2023, directly affecting New York State-regulated financial services companies, including insurers, crypto exchanges, mortgage servicers, foreign bank branches, money transmitters, student lenders, and fintech companies. The amended regulation, 23 NYCRR 500, often referred to as "Part 500," has been touted by DFS as a first-of-its-kind regulation that aimed at improving institutional cybersecurity preparedness, response, and governance in New York's financial services sector. Part 500 established various cybersecurity requirements for the so-defined "Covered Entity," including maintenance of a cybersecurity program and designation of a qualified Chief Information Security Officer (CISO) overseeing the program; implementation of a written cybersecurity policy; regularly conducted vulnerability assessments; multi-factor authentication for external access to the company's server; mandatory reporting of serious data breaches; and employee training.