Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Filing Deadline for New Infosec Law Hits NY Finance Firms Thursday
Banks and financial services companies in New York must file by tomorrow to certify they are compliant with the state Department of Financial Services’ new cybersecurity regulation, 23 NYCRR 500.
1 Min Read
Banks, insurers, and other financial services organizations in New York state have until tomorrow to file for their first annual certification of compliance with 23 NYCRR 500, the New York State Department of Financial Services' historic cybersecurity regulation.
The law officially went into effect March 2017; covered entities must be in compliance with the bulk of the regulation by March 1. This includes sections 500.04(b), 500.05, 500.09, 500.12, and 500.14(b) of the law, which mandate risk assessments, vulnerability assessments, penetration testing, multi-factor authentication, and end-user awareness training.
Enforcement for the law's security incident reporting rule went into effect in August, requiring companies to report within 72 hours any event that has a "reasonable likelihood" of causing material harm to normal operations - a unique notification rule that goes beyond PII breaches to cover anything from intellectual property leaks to DDoSes.
The next compliance deadline - on rules for data use, data access, security personnel, and more - hits Sep. 18.
For more information, see here.
About the Author
You May Also Like
More Insights
