Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

The New York State Department of Financial Services (NYDFS) recently amended its cybersecurity regulation, 23 NYCRR 500 (or Part 500), effective Nov. 1, 2023, which we wrote about <a href="https://www.bakerlaw.com/insights/nydfs-significantly-amends-cybersecurity-regulation/" target="_blank" rel="noreferrer noopener">here</a>. Covered entities must still certify compliance with Part 500 by April 15 each year – that’s not new. What is new, however, is that covered entities now must submit to NYDFS either a Certification of Material Compliance or an Acknowledgment of Noncompliance for the 2023 calendar year by April 15, 2024.

core/paragraph

Covered entities now are only required to certify “material” compliance with Part 500 during the prior calendar year.<ul><li>This change now allows a covered entity to certify even if it identifies minor areas of potential noncompliance.</li></ul>

core/list

core/list-item

Certification of Material Compliance must be based on data and documentation sufficient to demonstrate material compliance.<ul><li>Under the revised regulation, the certification must be “based upon data and documentation sufficient to accurately determine and demonstrate such material compliance including, to the extent necessary, documentation of officers, employees, representatives, outside vendors and other individuals or entities, as well as other documentation whether in the form of reports, certifications, schedules or otherwise.”</li></ul>

The new regulation provides an option for covered entities to submit an Acknowledgment of Noncompliance instead of a Certification of Material Compliance.<ul><li>Under the prior version of Part 500, a covered entity could not certify compliance for the prior year if it discovered any area of noncompliance, regardless of how minor the deficiency or how quickly it was remediated.</li></ul>

The certification or acknowledgment must be signed by the highest-ranking executive and the CISO.<ul><li>The updated Part 500 now requires the certification or acknowledgment to be signed by both the CISO (or senior officer responsible for the covered entity’s cybersecurity program) and the covered entity’s highest-ranking executive.</li></ul>

What you can do now to make sure you are ready for April 15

core/heading

Identify the Highest-Ranking Executive for the Covered Entity: Determining the appropriate person to sign as the highest-ranking executive isn’t always straightforward given the complexities of some covered entities’ organizational structures.

Develop a Strategy to Address Any Areas of Noncompliance: The new Acknowledgment of Noncompliance requires not only an explanation of the areas of noncompliance but also either a confirmation that the failures have been remediated or a timeline to remediate the failures.

Get Your Documentation Ducks in a Row: The revised regulation requires the certification to be based on “data and documentation” as described above.

Review the Step-by-Step Guides for Submitting the Certification or Acknowledgment: Know what to expect and avoid last-minute surprises by reviewing the step-by-step submission guides prepared by NYDFS for the <a href="https://www.dfs.ny.gov/system/files/documents/2024/01/Instructions_Certification_of_Material_Compliance_for_Entities.pdf" target="_blank" rel="noreferrer noopener">certification</a> or <a href="https://www.dfs.ny.gov/system/files/documents/2024/01/Instructions_Acknowledgment_of_Noncompliance_for_Entities.pdf">acknowl</a><a href="https://www.dfs.ny.gov/system/files/documents/2024/01/Instructions_Acknowledgment_of_Noncompliance_for_Entities.pdf" target="_blank" rel="noreferrer noopener">e</a><a href="https://www.dfs.ny.gov/system/files/documents/2024/01/Instructions_Acknowledgment_of_Noncompliance_for_Entities.pdf">dgment</a>, as applicable.

Are You Ready for It? NYDFS Annual Cybersecurity Certification Deadline April 15