By February 15, 2018, all Covered Entities, as explained below, were required to submit a signed written statement ("Notice") to the Superintendent of Financial Services (the "Superintendent"), certifying that they were in compliance with the Cybersecurity Requirements for Financial Services Companies ("Regulations") for the prior calendar year. In March 2018, we are now starting to see the Superintendent looking to enforce the Regulations by contacting Covered Entities who did not timely submit their Notices.

As of March 1, 2017, the New York State Department of Finance's ("DFS") new Regulations apply to all entities authorized to operate under the New York Banking Law, Financial Services Law, or Insurance Law ("Covered Entities"). The Regulations require stringent procedures to protect sensitive data. As of August 28, 2017, most Covered Entities were required to:

  • Begin maintaining a cybersecurity program;
  • Implement and maintain a written cybersecurity policy;
  • Designate a Chief Information Security Officer ("CISO") and appropriately staff cybersecurity personnel; and
  • Establish a written incident response plan.

Further, as of March 1, 2018, many Covered Entities were further required to: " Have the Covered Entity's CISO issue an internal report related to the Covered Entity's cybersecurity program and material cybersecurity risks;

  • Implement continuous monitoring or periodic penetration testing and vulnerability assessments; and
  • Provide cybersecurity awareness training for all personnel.

If you were contacted by the Superintendent for failing to file a Certification of Compliance, you need to assess your requirements under the Regulations and file the required documentation. Please note, certain partial exemptions may apply to you. Qualified counsel should be consulted as filing (or not filing) documentation could have adverse legal implications.

If you are unsure as to why you were contacted by DFS, you may want to check your registrations under DFS's portal:

https://myportal.dfs.ny.gov/nylinxext/elsearch.alis  

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.