Cyberregulation and the meaning of reasonable cybersecurity measures are changing rapidly. Insurance companies are in the red zone for new regulatory schemes and heightening expectations of duties of care that are well beyond the responsibility of a company's CIO. In January, the New York State Department of Financial Services (NYDFS) promulgated 23 NYCRR 500, a first-of-its-kind cyberregulation that requires companies to conduct assessments of their information systems and affirmatively build cybersecurity policies and programs based on those assessments. This includes creating oversight committees of senior officers, reliable chains of communication, and internal reports to educate appropriate decision-makers. The regulation also requires companies to make determinations as to the materiality of risks and events that may implicate other reporting obligations, such as SEC reporting requirements of public entities. The approach outlined in the NYDFS regulation is catching on. Recent NAIC Insurance Data Security Model Law drafts (drafts four and five) are based on the regulation and incorporate many of the same requirements. So is pending legislation in other states.

Simply put, the regulation and other legislation to come will require insurance companies, brokers, and soon their lawyers, to change their management and corporate culture toward cybersecurity or face certain liability. For those insurers that conduct business in New York and have not yet taken action, time is running out. Here are five things that every insurance carrier, its general counsel and its board of directors should know about these new cybersecurity regulations.

• Yes, Aug. 28. Any insurer or broker who operates under a license, accreditation, or similar authorization under New York's Banking Law, the Insurance Law, or the Financial Services Law must comply with significant portions of the NYDFS regulation by Aug. 28. There is no safe harbor or time extension. The requirements include implementing and maintaining a written cybersecurity policy, implementing a cybersecurity program designed to protect the confidentiality, integrity and availability of the company's “information systems,” appointing a “qualified individual” as a chief information security officer (CISO), instituting access privileges utilization of cybersecurity personnel (either in-house or through a third-party service provider), and implementation of a written incident response plan designed to promptly respond to and recover from any cybersecurity event. Assessments must include any subsidiary or affiliate of the insurer that may have access to the insurer's “information systems” or stored “nonpublic information.”