On September 4, 2018, the third stage of compliance deadlines under the New York Department of Financial Services’ (DFS) expansive cybersecurity regulation went into effect. This deadline, scheduled for implementation 18 months after the regulation (23 NYCRR 500) initially went into effect in March 2017 triggers Covered Entities’ obligations under the regulation to:
-
Maintain systems that include audit trails that can detect and respond to security incidents; (b) establish procedures (Section 500.06);
-
Include in their cybersecurity program written procedures, guidelines and standards designed to ensure the use of secure development practices for in-house applications and to evaluate the security of externally developed applications (Section 500.08);
-
Establish policies and procedures for the periodic disposal of nonpublic information no longer necessary for business operations or for other legitimate business purposes (Section 500.13);
-
Implement risk-based policies, procedures and controls designed for training and monitoring authorized users of systems (Section 500.14(a)); and
-
Based on the company’s risk assessment, implement controls, including encryption, to protect nonpublic information both in transit over external networks and at rest (Section 500.15).
As noted in Section 500.15, the requirement to implement encryption for nonpublic data both in transit and at rest is dependent on the company’s risk assessment. The regulation requires that each Covered Entity develop its cybersecurity program around. To the extent the company determines that encryption is not feasible, the regulation permits Covered Entities to implement alternative controls reviewed and approved by the Company’s Chief Information Security Officer.
Under the regulation, Covered Entities are required to certify compliance on an annual basis, with the next scheduled certification deadline set for February 15, 2019. The final deadline under the regulation is scheduled for implementation on March 1, 2019, and will require Covered Entities to implement a Third-Party Service Provider Security Policy as mandated under Section 500.11 of the regulation.
[View source.]
