Commentary Addressing Risks and Opportunities Through the Life Cycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright size-medium wp-image-4733" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2016/11/digital-currency-iStock-484477110-300x225.jpg" alt="" width="300" height="225" />With the first <a href="http://dfs.ny.gov/about/cybersecurity.htm">compliance deadline</a> now less than two months away, the New York Department of Financial Services (NYDFS) has provided additional clarity concerning its new Cybersecurity Requirements for Financial Services Companies (the “Cybersecurity Regulation”) by publishing an update to previously issued Frequently Asked Questions.

We reported on the forthcoming Cybersecurity Regulation in <a href="https://www.dataprivacymonitor.com/cybersecurity/new-york-department-of-financial-services-issues-revised-cybersecurity-regulations/">January</a> and <a href="https://www.dataprivacymonitor.com/cybersecurity/finalized-new-york-department-of-financial-services-cybersecurity-regulation-to-take-effect-march-1/">February</a>.

The <a href="http://dfs.ny.gov/about/cybersecurity_faqs.htm">new FAQs</a> address the applicability of the Cybersecurity Regulation to three different types of entities. [1]
<ul>
 	<li>New York Branches of Out-of-State Banks. Pursuant to a 1997 Nationwide Cooperative Agreement among state banking regulators, NYDFS “will defer to the home state supervisor for supervision of New York branches.” However, NYDFS “maintains the right to examine branches located in New York” as they still must comply with New York law. Accordingly, NYDFS “strongly encourages all financial institutions, including New York branches of out-of-state domestic banks” to adopt safeguards and protections consistent with the Cybersecurity Regulation.</li>
 	<li>Subsidiaries and Other Affiliates. A Covered Entity must include Affiliates in its Risk Assessment to determine whether they present risks to the Covered Entity’s Information Systems or Nonpublic Information. If so, those risks must be addressed in the Covered Entity’s cybersecurity program and written cybersecurity policy.</li>
 	<li>Exempt Covered Entities. Because the exemptions set forth in Section 500.19 of the Cybersecurity Regulation are “limited in scope,” exempt Covered Entities must still comply with certain provisions of the Cybersecurity Regulation. For example (not listed in the FAQs), a Covered Entity that is exempt under Section 500.19(a) must still conduct a Risk Assessment that informs its cybersecurity program, written cybersecurity policy, access privileges, Third Party Service Provider security policy and data retention practices. Such an exempt Covered Entity also would be required to notify NYDFS of covered Cybersecurity Events and annually certify its compliance to the Superintendent.</li>
</ul>
We will continue to monitor and provide updates regarding additional NYDFS guidance or interpretations relevant to implementation of the Cybersecurity Regulation.

[1] Note: capitalized terms not defined below are defined in the <a href="http://dfs.ny.gov/legal/regulations/adoptions/dfsrf500txt.pdf">Cybersecurity Regulation</a>.

&nbsp;

New York DFS Updates FAQs to Clarify Applicability of Cybersecurity Regulation