United States: New York State Cybersecurity Regulations: First Milestone In Sight, What Is Next On The Horizon?

The New York State Department of Financial Services ("NYDFS") enacted final cybersecurity regulations ("Regulations") for NYDFS regulated entities that went into effect on March 1, 2017.¹ The first deadline for compliance under the Regulations is August 28, 2017, by which date covered entities are required to, among other things, create a written cybersecurity policy and appoint a Chief Information Security Officer ("CISO").² The Regulations also require an annual certification by the Chairperson of the covered entity's Board of Directors (or a senior officer) as to the entity's compliance with the Regulations. As the first such certification is required to be made by February 15, 2018, and the NYDFS has issued updated Frequently Asked Questions ("FAQs")³ that provide additional compliance guidance, now is the time to look beyond the first deadline and begin taking action.

The ten steps set forth below will help a covered entity's Board ensure that they will be prepared to make the certification come February:

Evaluate the Applicability of the Regulations

The recent FAQs have clarified that not only are New York branches and agencies of foreign banks subject to the Regulations, but representative offices are within scope, as well. The Regulations also provide for exemptions from certain specified provisions of the Regulations for covered entities satisfying certain criteria. If the elements of an exemption are met, such a notice of exemption may be filed electronically with the NYDFS.

A covered entity may adopt some or all of the cybersecurity program of an affiliated entity, provided the covered entity's overall program satisfies the Regulations. The annual certification must be completed by the covered entity; this cannot be completed by an affiliated entity. 

Know the Deadlines

The Regulations call for rolling deadlines for compliance spread over the next two years. Meeting each deadline is critical to maintaining compliance with the Regulations. In the recent FAQs, the NYDFS clarified that compliance with currently applicable requirements can be subject to updates and revisions to reflect later implemented requirements. 

• August 28, 2017: Covered entities must establish and maintain a cybersecurity program, including a cybersecurity policy approved by the Board or a senior officer, the appointment of a CISO, access privileges to protect non-public information and procedures to notify the NYDFS of cybersecurity events.
• February 15, 2018: The Chairperson of the Board (or a senior officer) is required to submit its first certification to the NYDFS as to compliance with the Regulations. The NYDFS expects full compliance by this date, subject to requirements still subject to transition periods.
• March 1, 2018: Covered entities must have:
  
  
  • submitted to the Board (or a senior officer) the CISO's report on the covered company's cybersecurity program;
  • conducted penetration testing and a vulnerability assessment;
  • conducted a risk assessment;
  • implemented multi-factor authentication; and
  • provided regular cybersecurity awareness training to personnel.

• September 3, 2018: The 18-month transition period ends and the entity must have built out its cybersecurity program to include:
  
  
  • an audit trail;
  • written procedures, guideline and standards for the security of in-house or externally developed applications;
  • data retention policies and controls to protect nonpublic information;
  • policies and procedures to monitor the activity of authorized users; and
  • controls, including encryption, to protect non-public information.

• March 1, 2019: Covered entities must implement cybersecurity policies to cover third-party service providers.

Know the Consequences

The Regulations are enforced by the Superintendent of the NYDFS. Practically, this means that the NYDFS will incorporate compliance with the Regulations into its regular exam process and could impose fines or revoke an entity's license for noncompliance and potentially even hold personally liable the Board member or officer who signed the annual certification. Entities may face reputational or litigation risks to the extent they are found to be out of compliance with the Regulations or if they become victims of a material cyber incident.

Hire the Right People

Management should present the Board with a qualified CISO. Depending on the entity's risk assessment, the Board should weigh the costs and benefits of having an internal CISO or hiring a third-party CISO. A covered entity may use an affiliated entity's employee as its CISO. The affiliated CISO will not be considered a third-party provider, but the covered entity must ensure that the CISO is abiding by the Regulations. 

All of the entity's cybersecurity personnel must be qualified and receive updates and training sufficient to address and manage cybersecurity risks to the entity. Further, all personnel of the entity should receive regular cybersecurity awareness training.

Create a Reporting Plan

The Regulations call for reporting cybersecurity events in certain circumstances. A Board should ensure that a firm's incident response plan contemplates the circumstances under which reporting may be required. 

• Covered entities are not required to report to the NYDFS all unsuccessful attacks, but they are required to report attempts that are sufficiently serious to raise a concern. 
• Covered entities are required to report to the NYDFS certain cybersecurity events, including any event (i) of which notice is required to be provided to a government body or regulator, (ii) that is likely to harm a material part of the operations of the covered entity, or (iii) that involves actual or potential harm to consumers. 
• Covered entities are required to provide notice to consumers that are affected by a cybersecurity event. 

An entity's incident response plan should contemplate the deadline for submitting a notice (72 hours in certain circumstances) as well as the form for reporting. 

Conduct a Risk Assessment

Boards should ensure that the CISO undertakes and documents a comprehensive cyber risk assessment as required by the Regulations as soon as practicable, followed by periodic assessments going forward. The CISO should present the results of the assessment to the Board or one of its committees.

Tailor the Cybersecurity Program

Management should present the Board with an overview of the entity's cybersecurity program, including a discussion of the controls implemented, together with an explanation as to how management weighed the identified risks and how the entity's cybersecurity program is tailored to address such risks. Ongoing monitoring and testing of the entity's cybersecurity program, as required by the Regulations, should inform updates to the program.

Consider Third-Party Risk Management

The Regulations require firms to ensure that their systems and nonpublic information are also secure in the hands of third-party service providers. While satisfaction of this requirement has the longest transition period for compliance, compliance will require a significant undertaking. Firms will need to inventory and diligence all relevant third-party service providers to evaluate, among other things, the type of information provided to such providers and providers' cybersecurity practices, to establish policies and procedures for relationships with third-party providers and to review and update contractual agreements governing relationships with third-party service providers. Covered entities are required to make a risk assessment as to each service provider regarding the requisite appropriate controls that should be established rather than adopt a "one-size-fits-all" solution.

Create a Paper Trail

In addition to ensuring that adequate cybersecurity policies and procedures are in place and being observed, covered entities are required to maintain systems designed to reconstruct material financial transactions sufficient to support normal operations and to create an audit trail to detect and respond to material cyber incidents.

Strike a Balance

The CISO is responsible for reporting annually to the Board as to the entity's cybersecurity program and material cybersecurity risks. Boards will need to be well-informed about the entity's compliance with the Regulations without being overburdened. While Board members are not expected to be involved in the day-to-day decision-making regarding the cybersecurity policy, they must receive sufficiently detailed data to make informed decisions.

For a more detailed overview of the NYDFS Regulations or to learn how they could affect your organization, please contact one of us or consult our firm's primer.

Footnotes

1 Available at: http://www.dfs.ny.gov/legal/regulations/adoptions/rf23-nycrr-500_cybersecurity.pdf. For additional information regarding the NYDFS Regulations, please see our firm's publication, available at: http://www.shearman.com/~/media/Files/NewsInsights/Publications/2017/04/Primer-of-the-New-NYDFS-Cybersecurity-Regulation.pdf.

2 "Covered Entity" under the Regulations means any person operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under New York Banking Law, Insurance Law or Financial Services Law. The phrase is intended to include New York branches, agencies and representative offices of out-of-country foreign banks.

3 Available at: http://www.dfs.ny.gov/about/cybersecurity_faqs.htm.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.