<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

Financial Services

The NYDFS Cybersecurity Regulation Explained

down-arrow

In 2017 the New York State Department of Financial Services (NYDFS) created the NYDFS cybersecurity regulation 23 NYCRR 500, which held financial institutions accountable for maintaining their cybersecurity program. These regulation requirements, heavily based on the NIST Cybersecurity Framework, demand regulated entities to assess their cybersecurity risk and proactively improve them, while also allowing for flexibility based on the needs, scope, and influence of a financial institution. As such, to be compliant with New York Department of Financial Services cybersecurity regulations, organizations will need to maintain cybersecurity obligations continuously. As the threat of data breaches and cyber attacks grows by the day, so does the need for regulation to protect organizations and provide a measurable standard of operation.

The NYDFS cybersecurity regulation applies to any financial institution in operation under NYDFS licensure, including:

  • State banks
  • Licensed Lenders
  • Private Banks
  • Foreign Banks operating in New York
  • Mortgage Companies
  • Insurance companies
  • Trust companies
  • Service providers

The 23 NYCRR 500 regulation includes limited exemptions for financial institutions with less than ten employees and less than 5 million in gross annual revenue in the past three years. Additionally, institutions that do not have any nonpublic information or sensitive data are entitled to certain exemptions as well.

Proving Compliance with NYDFS

Taking influence from the NIST CSF, NYDFS is requiring companies to develop a data security policy and implement an incident response plan that includes a notification system for data breaches and cybersecurity events within 72 hours. Under this NYDFS regulation, a program must coincide with best practices that support:

  • Information Security
  • Access Controls and identity management
  • Business continuity and disaster recovery planning
  • Security and Personnel Training
  • Security of information systems
  • Network Security
  • Periodic risk assessments
  • Internal reporting and auditing
  • Data Encryption and Protection
  • Threat Feed Detection
  • Incident Response Plans
  • Multi-Factor Authentication
  • Vendor/ Third-Party Risk Assessments

Utilizing risk assessments to benchmark and assess the posture of your cybersecurity program is essential.At the end of each year, financial institutions need to complete an annual certification process in coordination with the board of directors to evaluate their cybersecurity program. At the end of this process, the organization will need to provide a Certification of Compliance with NYDFS Cybersecurity Regulation.

Utilizing an integrated risk management platform like CyberStrong can help streamline this process and many other gold standard frameworks. Integrated risk management can centralize compliance efforts, saving cybersecurity teams and Chief Information Security Officers (CISOs)valuable time, energy, and resources, bridging the gap between cybersecurity and the board to translate the importance of the organization’s cybersecurity needs fully. By integrating dashboards, patented AI, and groundbreaking reporting to your cybersecurity program, you can prove your compliance with NYDFS cybersecurity regulations and multiple other custom frameworks and controls with an audit trail in hours instead of days.

If you have any additional questions about integrated risk management or how CyberStrong can help bolster your institution’s cybersecurity objectives, give us a call at 1 800 NIST CSF or click here and request a free demo.

You may also like

Conducting Your First Risk ...
on January 30, 2023

As digital adoption across industries increases, companies are facing increasing cybersecurity risks. Regardless of their size, cyber-attacks are a persistent threat that must be ...

Your Guide to Cloud Security ...
on January 26, 2023

Cloud computing refers to the delivery of multiple services via the internet (also known as the “cloud”), including software, databases, servers, storage, intelligence, and ...

Compliance and Regulations for ...
on January 9, 2023

Compliance for many cybersecurity programs has been the cornerstone and the catalyst for why many programs exist in the first place. Since the rise of the information technology ...

Cyber Risk Quantification: Metrics ...
on January 6, 2023

Risk management is the new foundation for an information security program. Risk management, coupled with necessary compliance activities to support ongoing business operations, ...

Padraic O'Reilly
Cybersecurity Maturity Models You ...
on January 27, 2023

Cybercrime has forced businesses worldwide into paying billions of dollars yearly. As more of the population becomes dependent on technology, the fear of cyber attacks continues ...

Top 10 Risks in Cyber Security
on December 23, 2022

Increasing cyber security threats continue creating problems for companies and organizations, obliging them to defend their systems against cyber threats. According to research ...