The Second Amendment to the New York Department of Financial Services' ("NYDFS") Cybersecurity Requirements for Financial Services Companies (the "NYDFS Requirements") is expected to be published in final form in the next two weeks. The Second Amendment will follow updated proposed amendments to the NYDFS Requirements published on June 28, 2023 (the "2023 Proposal"),1 which were revised after the proposed amendments were first formally published on November 9, 2022.2 The comment period for the 2023 Proposal ended on August 14, 2023.
The New York State Administrative Procedure Act ("SAPA") ordinarily requires an agency to adopt a proposed rule within one year of the publication in the state register of the notice of proposed rulemaking, or else the proposed rule expires.3 We expect that NYDFS will seek to finalize the Second Amendment prior to November 9. As New York State typically publishes new regulations on Wednesdays, we can expect the NYDFS to publish the final amendment on November 1 or 8.
We expect few changes between the final regulation and the 2023 Proposal. SAPA requires a notice and comment period for substantive changes to proposed rules prior to publication, which means the final rule should not contain any new requirements that were not subject to notice and comment.4 The changes in the final regulation are therefore likely to be clarifications to, or narrowing of, the new requirements in the 2023 Proposal.
In anticipation of the upcoming final regulation, please see our past publications on the NYDFS Requirements:
- Mayer Brown, The Newly Revised NYDFS Cyber Requirements for Financial Services Companies What you Need to Know About the Proposal (July 12, 2023), available at The Newly Revised NYDFS Cyber Requirements for Financial Services Companies What you Need to Know About the Proposal | Perspectives & Events | Mayer Brown.
- Mayer Brown, NYDFS Expands Cybersecurity Requirements for Licensed Financial Services Companies (July 6, 2023), available at NYDFS Expands Cybersecurity Requirements for Licensed Financial Services Companies | Perspectives & Events | Mayer Brown.
- Mayer Brown, Cyber Spotlight: NYDFS Cybersecurity Regulation – What Do the Proposed Changes and Increasing Enforcement Mean for Covered Entities? (October 11, 2022), available at Cyber Spotlight: NYDFS Cybersecurity Regulation – What Do the Proposed Changes and Increasing Enforcement Mean for Covered Entities? | Perspectives & Events | Mayer Brown.
Footnotes
1 NYDFS, Updated Proposed Second Amendment to 23 N.Y.C.R.R. pt. 500 (June 28, 2023), https://www.dfs.ny.gov/system/files/documents/2023/06/rev_rp_23a2_text_20230628.pdf; NYDFS, Cybersecurity Requirements for Financial Services Companies XLV (No. 26) N.Y. Reg. 23-27 (June 28, 2023), https://dos.ny.gov/system/files/documents/2023/06/062823.pdf.
2 NYDFS, Cybersecurity Requirements for Financial Services Companies XLIV (No. 45) N.Y. Reg. 26-28 (Nov. 9, 2022), https://dos.ny.gov/november-9-2022vol-xliv-issue-45.
3 State Administrative Procedure Act, §202.2(a), available at NYS Open Legislation | NYSenate.gov.
4 State Administrative Procedure Act, §202.4-a, available at NYS Open Legislation | NYSenate.gov.
Visit us at mayerbrown.com
Mayer Brown is a global services provider comprising associated legal practices that are separate entities, including Mayer Brown LLP (Illinois, USA), Mayer Brown International LLP (England & Wales), Mayer Brown (a Hong Kong partnership) and Tauil & Chequer Advogados (a Brazilian law partnership) and non-legal service providers, which provide consultancy services (collectively, the "Mayer Brown Practices"). The Mayer Brown Practices are established in various jurisdictions and may be a legal person or a partnership. PK Wong & Nair LLC ("PKWN") is the constituent Singapore law practice of our licensed joint law venture in Singapore, Mayer Brown PK Wong & Nair Pte. Ltd. Details of the individual Mayer Brown Practices and PKWN can be found in the Legal Notices section of our website. "Mayer Brown" and the Mayer Brown logo are the trademarks of Mayer Brown.
© Copyright 2023. The Mayer Brown Practices. All rights reserved.
This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.
