NY DFS Regulation: Certify Your Compliance by February 15 and Assess Your Risk by March 1

The New York Department of Financial Services' (DFS) cybersecurity regulation (DFS Regulation), which took effect on March 1, 2017, imposes significant requirements on financial services companies doing business in New York. Covered entities are likely already familiar with much of the rule, as the first transitional period ended on August 28, 2017 (see our previous client alert for a summary of compliance steps). By February 15, 2018, covered entities must submit their first annual certification of compliance with the regulation. Also around the corner is the deadline for additional required steps, such as completing a risk assessment and implementing multi-factor authentication. In-house counsel should ensure that those compliance steps are taken by the end of the second transition period on March 1, 2018.

Even companies that are not subject to the DFS Regulation would do well to get out ahead of the issue, since the trend of industry-targeted cybersecurity regulation seems likely to continue. In September 2017, Governor Andrew Cuomo directed the DFS to increase the scope of the DFS Regulation to apply to credit reporting agencies, which must now register with DFS and comply with the DFS Regulation. Cybersecurity experts expect that that other regulatory and law enforcement agencies will look to the DFS Regulation in developing their own cybersecurity regulations.