The New York State Department of Financial Services (NYDFS) has updated the 23 NYCRR 500 regulation titled “Cybersecurity Requirements for Financial Services Companies.” Companies must be able to provide documentation of compliance with the majority of updated requirements, which include the following:
Asset inventory, data classification/sensitivity and encryption
Complete an annual independent audit of the cybersecurity program
Implement a privileged access management solution
Solutions and controls to prevent usage of common passwords
Implement a detection and response system (XDR)
The storage of backups isolated from client network connections and annual testing
Require users to authenticate via Multi-Factor Authentication (MFA)
Monitor for anomalous activity and generate alerts
Incident response and business continuity management
Documentary evidence demonstrating compliance
Larger companies (“Class A” companies), with aggregate revenue from New York operations and over $1 billion globally, or 2,000 employees globally, must also:
Complete an annual independent audit of cybersecurity program
Implement a privileged access management solution and controls to prevent the usage of common passwords for privileged accounts
Implement an end-point detection and response system to monitor for anomalous activity and generate alerts
Implement an end-point detection and response system to monitor for anomalous activity and generate alerts
Enhance business continuity and disaster recovery protocols, including the identification of critical data, the storage of backups isolated from client network connections, and annual testing
Require users to authenticate via Multi-Factor Authentication
The regulation also requires a compliance filing, with supporting documentary evidence, which raises the risk of firms falling short and incurring millions in fines. Companies must also implement new controls, increase the frequency of existing cyber controls, and ensure that their compliance with the regulation is documented.
Least privileged access management solution (section 500.7 on pages 8-9) Encryption (section 500.15 on page 12)
Data Classification/Sensitivity (section 500.13, page 12)
Data retention requirements (section 500.3 on page 5 and section 500.13 on pages 11-12)
Backup and recovery (section 500.16 on pages 13-15)
