<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

Financial Services

The NYDFS Cybersecurity Regulation Explained

down-arrow

In 2017 the New York State Department of Financial Services (NYDFS) created the NYDFS cybersecurity regulation 23 NYCRR 500, which held financial institutions accountable for maintaining their cybersecurity program. These regulation requirements, heavily based on the NIST Cybersecurity Framework, demand regulated entities to assess their cybersecurity risk and proactively improve them, while also allowing for flexibility based on the needs, scope, and influence of a financial institution. As such, to be compliant with New York Department of Financial Services cybersecurity regulations, organizations will need to maintain cybersecurity obligations continuously. As the threat of data breaches and cyber attacks grows by the day, so does the need for regulation to protect organizations and provide a measurable standard of operation.

The NYDFS cybersecurity regulation applies to any financial institution in operation under NYDFS licensure, including:

  • State banks
  • Licensed Lenders
  • Private Banks
  • Foreign Banks operating in New York
  • Mortgage Companies
  • Insurance companies
  • Trust companies
  • Service providers

The 23 NYCRR 500 regulation includes limited exemptions for financial institutions with less than ten employees and less than 5 million in gross annual revenue in the past three years. Additionally, institutions that do not have any nonpublic information or sensitive data are entitled to certain exemptions as well.

Proving Compliance with NYDFS

Taking influence from the NIST CSF, an organization will need to develop a data security policy and implement an incident response plan that includes a notification system for data breaches and cybersecurity events within 72 hours. Under this NYDFS regulation, a program must coincide with best practices that support:

  • Information Security
  • Access Controls and identity management
  • Business continuity and disaster recovery planning
  • Security and Personnel Training
  • Security of information systems
  • Network Security
  • Periodic risk assessments
  • Internal reporting and auditing
  • Data Encryption and Protection
  • Threat Feed Detection
  • Incident Response Plans
  • Multi-Factor Authentication
  • Vendor/ Third-Party Risk Assessments

Utilizing risk assessments to benchmark and assess the posture of your cybersecurity program is essential.At the end of each year, financial institutions need to complete an annual certification process in coordination with the board of directors to evaluate their cybersecurity program. At the end of this process, the organization will need to provide a Certification of Compliance with NYDFS Cybersecurity Regulation.

Utilizing an integrated risk management platform like CyberStrong can help streamline this process and many other gold standard frameworks. Integrated risk management can centralize compliance efforts, saving cybersecurity teams and Chief Information Security Officers (CISOs)valuable time, energy, and resources, bridging the gap between cybersecurity and the board to translate the importance of the organization’s cybersecurity needs fully. By integrating dashboards, patented AI, and groundbreaking reporting to your cybersecurity program, you can prove your compliance with NYDFS cybersecurity regulations and multiple other custom frameworks and controls with an audit trail in hours instead of days.

If you have any additional questions about integrated risk management or how CyberStrong can help bolster your institution’s cybersecurity objectives, give us a call at 1 800 NIST CSF or click here and request a free demo.

You may also like

Why You Need CIS Controls for ...
on June 17, 2022

The Center for Internet Security (CIS) is a non-profit organization that helps public sectors and private sectors improve their cybersecurity. The organization aims to help small, ...

Small Business Cybersecurity ...
on June 15, 2022

To achieve peace of mind in the modern threat landscape, small business owners must have a solid security strategy and budget in place. VIPRE’s SMB Security Trends report state ...

Do Small Businesses and Startups ...
on June 10, 2022

Did you know that about 60% of small businesses shut down within 6 months by falling victim to a data breach or cyber-attack, where the average global breach cost hovers at $3.62 ...

A Pocket Guide to ISO 27001
on June 9, 2022

Let’s begin with the complete title of what’s referred to as ISO 27001. It is officially known as “ISO/IEC 27001." If you're looking to have your company certified, you'll need to ...

Benefits Of An Automated Security ...
on June 6, 2022

Proactive recognition, remediation, and mitigation of security threats are rising challenges for global businesses today. Security risk assessment is an integral part of this ...

Kyndall Elliott
The Top 5 Automated Risk ...
on June 1, 2022

Automated risk assessment tools help you assess information security risks and related metrics in real-time based on the available data internally and externally. Connecting the ...