August 22, 2017
The New York State Department of Financial Services (“NYDFS”) enacted final cybersecurity regulations (“Regulations”) for NYDFS regulated entities that went into effect on March 1, 2017. The first deadline for compliance under the Regulations is August 28, 2017, by which date covered entities are required to, among other things, create a written cybersecurity policy and appoint a Chief Information Security Officer (“CISO”). The Regulations also require an annual certification by the Chairperson of the covered entity’s Board of Directors (or a senior officer) as to the entity’s compliance with the Regulations. As the first such certification is required to be made by February 15, 2018, and the NYDFS has issued updated Frequently Asked Questions (“FAQs”) that provide additional compliance guidance, now is the time to look beyond the first deadline and begin taking action.
The ten steps set forth below will help a covered entity’s Board ensure that they will be prepared to make the certification come February:
The recent FAQs have clarified that not only are New York branches and agencies of foreign banks subject to the Regulations, but representative offices are within scope, as well. The Regulations also provide for exemptions from certain specified provisions of the Regulations for covered entities satisfying certain criteria. If the elements of an exemption are met, such a notice of exemption may be filed electronically with the NYDFS.
A covered entity may adopt some or all of the cybersecurity program of an affiliated entity, provided the covered entity’s overall program satisfies the Regulations. The annual certification must be completed by the covered entity; this cannot be completed by an affiliated entity.
The Regulations call for rolling deadlines for compliance spread over the next two years. Meeting each deadline is critical to maintaining compliance with the Regulations. In the recent FAQs, the NYDFS clarified that compliance with currently applicable requirements can be subject to updates and revisions to reflect later implemented requirements.
The Regulations are enforced by the Superintendent of the NYDFS. Practically, this means that the NYDFS will incorporate compliance with the Regulations into its regular exam process and could impose fines or revoke an entity’s license for noncompliance and potentially even hold personally liable the Board member or officer who signed the annual certification. Entities may face reputational or litigation risks to the extent they are found to be out of compliance with the Regulations or if they become victims of a material cyber incident.
Management should present the Board with a qualified CISO. Depending on the entity’s risk assessment, the Board should weigh the costs and benefits of having an internal CISO or hiring a third-party CISO. A covered entity may use an affiliated entity’s employee as its CISO. The affiliated CISO will not be considered a third-party provider, but the covered entity must ensure that the CISO is abiding by the Regulations.
All of the entity’s cybersecurity personnel must be qualified and receive updates and training sufficient to address and manage cybersecurity risks to the entity. Further, all personnel of the entity should receive regular cybersecurity awareness training.
The Regulations call for reporting cybersecurity events in certain circumstances. A Board should ensure that a firm’s incident response plan contemplates the circumstances under which reporting may be required.
An entity’s incident response plan should contemplate the deadline for submitting a notice (72 hours in certain circumstances) as well as the form for reporting.
Boards should ensure that the CISO undertakes and documents a comprehensive cyber risk assessment as required by the Regulations as soon as practicable, followed by periodic assessments going forward. The CISO should present the results of the assessment to the Board or one of its committees.
Management should present the Board with an overview of the entity’s cybersecurity program, including a discussion of the controls implemented, together with an explanation as to how management weighed the identified risks and how the entity’s cybersecurity program is tailored to address such risks. Ongoing monitoring and testing of the entity’s cybersecurity program, as required by the Regulations, should inform updates to the program.
The Regulations require firms to ensure that their systems and nonpublic information are also secure in the hands of third-party service providers. While satisfaction of this requirement has the longest transition period for compliance, compliance will require a significant undertaking. Firms will need to inventory and diligence all relevant third-party service providers to evaluate, among other things, the type of information provided to such providers and providers’ cybersecurity practices, to establish policies and procedures for relationships with third-party providers and to review and update contractual agreements governing relationships with third-party service providers. Covered entities are required to make a risk assessment as to each service provider regarding the requisite appropriate controls that should be established rather than adopt a “one-size-fits-all” solution.
In addition to ensuring that adequate cybersecurity policies and procedures are in place and being observed, covered entities are required to maintain systems designed to reconstruct material financial transactions sufficient to support normal operations and to create an audit trail to detect and respond to material cyber incidents.
The CISO is responsible for reporting annually to the Board as to the entity’s cybersecurity program and material cybersecurity risks. Boards will need to be well-informed about the entity’s compliance with the Regulations without being overburdened. While Board members are not expected to be involved in the day-to-day decision-making regarding the cybersecurity policy, they must receive sufficiently detailed data to make informed decisions.
For a more detailed overview of the NYDFS Regulations or to learn how they could affect your organization, please contact one of us or consult our firm’s primer.
 Available at: http://www.dfs.ny.gov/legal/regulations/adoptions/rf23-nycrr-500_cybersecurity.pdf. For additional information regarding the NYDFS Regulations, please see our firm’s publication, available at: http://www.shearman.com/~/media/Files/NewsInsights/Publications/2017/04/Primer-of-the-New-NYDFS-Cybersecurity-Regulation.pdf.
 “Covered Entity” under the Regulations means any person operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under New York Banking Law, Insurance Law or Financial Services Law. The phrase is intended to include New York branches, agencies and representative offices of out-of-country foreign banks.
 Available at: http://www.dfs.ny.gov/about/cybersecurity_faqs.htm.