The New York State Department of Financial Services (DFS) recently unveiled its cybersecurity regulation for financial services companies, which takes effect on Jan. 1, 2017 (to be codified at 23 NYCRR 500 (2016)). This regulation, absent the very limited exemptions provided, applies to every banking and financial services entity licensed or chartered by DFS, including all foreign branches, agencies, representative offices and commercial lending companies licensed in New York State. (The definition of “Covered Entity,” 23 NYCRR 500.01(c), includes any Person operating or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the banking law, the insurance law or the financial services law (emphasis supplied).) The requirements set out in the regulation impose significant new ongoing operational, documentation and reporting obligations.
Cybersecurity Program. Each institution organized under the auspices of DFS must establish a cybersecurity program to ensure the confidentiality and integrity of its information systems. See 23 NYCRR 500.02. The program must be designed to perform various core functions, such as:
