Free Cyber Risk Analysis: Uncover Your Cyber Risks vs. Peers in Just 3 Clicks

Get Started
Request Demo

Financial Services

The NYDFS Cybersecurity Regulation Explained

down-arrow

In 2017 the New York State Department of Financial Services (NYDFS) created the NYDFS cybersecurity regulation 23 NYCRR 500, which held financial institutions accountable for maintaining their cybersecurity program. These regulation requirements, heavily based on the NIST Cybersecurity Framework, demand regulated entities to assess their cybersecurity risk and proactively improve them, while allowing for flexibility based on a financial institution's needs, scope, and influence. To comply with New York Department of Financial Services cybersecurity regulations, organizations will need to maintain cybersecurity obligations continuously. As the threat of data breaches and cyber attacks grows by the day, so does the need for regulation to protect organizations and provide a measurable standard of operation.

The NYDFS cybersecurity regulation applies to any financial institution in operation under NYDFS licensure, including:

  • State banks
  • Licensed Lenders
  • Private Banks
  • Foreign Banks operating in New York
  • Mortgage Companies
  • Insurance companies
  • Trust companies
  • Service providers

The 23 NYCRR 500 regulation includes limited exemptions for financial institutions with less than ten employees and less than 5 million in gross annual revenue in the past three years. Additionally, institutions that do not have any nonpublic information or sensitive data are also entitled to certain exemptions.

Proving Compliance with NYDFS

Taking influence from the NIST CSF, NYDFS is requiring companies to develop a data security policy and implement an incident response plan that includes a notification system for data breaches and cybersecurity events within 72 hours. Under this NYDFS regulation, a program must coincide with best practices that support:

  • Information Security
  • Access Controls and identity management
  • Business continuity and disaster recovery planning
  • Security and Personnel Training
  • Security of information systems
  • Network Security
  • Periodic risk assessments
  • Internal reporting and auditing
  • Data Encryption and Protection
  • Threat Feed Detection
  • Incident Response Plans
  • Multi-Factor Authentication
  • Vendor/ Third-Party Risk Assessments

Utilizing risk assessments to benchmark and assess the posture of your cybersecurity program is essential. At the end of each year, financial institutions need to complete an annual certification process in coordination with the board of directors to evaluate their cybersecurity program. At the end of this process, the organization will need to provide a Certification of Compliance with NYDFS Cybersecurity Regulation.

Utilizing an integrated risk management platform like CyberStrong can help streamline this process and many other gold standard frameworks. Integrated risk management can centralize compliance efforts, saving cybersecurity teams and Chief Information Security Officers (CISOs) valuable time, energy, and resources, bridging the gap between cybersecurity and the board to fully translate the importance of the organization’s cybersecurity needs. By integrating dashboards, patented AI, and groundbreaking reporting into your cybersecurity program, you can prove your compliance with NYDFS cybersecurity regulations and multiple other custom frameworks and controls with an audit trail in hours instead of days.

If you have any additional questions about integrated risk management or how CyberStrong can help bolster your institution’s cybersecurity objectives, give us a call at 1 800 NIST CSF or click here and request a free demo.

You may also like

Building Cyber Resilience: ...
on March 1, 2024

After several years of deliberation and collaboration with industry experts, NIST has released the newest version of the NIST CSF. The NIST CSF 2.0 builds on the draft version ...

How to Perform Cyber Risk Analysis ...
on February 26, 2024

In today's hyper-connected world, where data is the lifeblood of businesses and individuals alike, the threat of cyberattacks looms large. From sophisticated malware infiltrations ...

Decoding the Maze: A Guide to ...
on January 30, 2024

In today's digital age, organizations face the constant threat of cyber attacks. Safeguarding critical data and infrastructure requires a proactive approach, starting with a ...

January Product Update
on January 18, 2024

With the latest release of updates to the CyberStrong platform, we are dedicated to providing solutions that empower you to assess your cyber risk environment with the most ...

NIST CSF Adoption and Automation
on December 13, 2023

As a gold standard for cybersecurity in the United States and the foundation for many new standards and regulations starting to emerge today, the National Institute of Standards ...

Cyber Risk Quantification ...
on December 13, 2023

In an era dominated by interconnected systems and the ever-expanding digital landscape, cyber risk has transcended mere technical jargon to become a paramount concern for ...