The convergence of cyber security risk management regulation continues, as covered entities are required to submit annual notices of compliance to…

← Back to Blog

The convergence of cyber security risk management regulation continues, as covered entities are required to submit annual notices of compliance to amendments to NYDFS part 500 of 23 NYCRR 500.

Covered entities are required to submit a notice of compliance by the 15th of April 2024, requiring all companies to submit a Certification of Material Compliance or Acknowledgment of Noncompliance to the NYDFS.

By the 29th April 2024 covered organisations must comply with most of the provisions under amended Part 500 (e.g., 500.2(c); 500.3; 500.5(a)(1), (b), and (c); 500.9; and 500.14(a)(3)). Requiring independent audit of an entities cybersecuirty program based on its risk assessment; monitoring of privilege access; implement end point monitoring; requires a covered entity to have a qualified CISO; Senior Governing body oversight of cybersecurity; vulnerability management; access and privilege management; application security; a risk assessment reviewed annually; MFA; asset management; incident response, business continuity and disaster recovery plans, tested annually; reporting of cybersecuirty incident and extortion payments within 72 hours.

Importantly the regulation revises the certification process to include the option that the covered entity: certifies that it did or did not materially comply with the requirements. Certification signed by both the covered entity’s highest-ranking executive and CISO.

NYDFS is an influential financial services regulator. That is not afraid to demonstrate its oversight of regulatory compliance. One suspects given the maturity of cybersecurity risk management across financial services and its supply chains it may not be long before the regulator tests these regulatory amendments, and CISO and boards are questioned over certified cyber compliance.

@Thaddeus Dziekanowski Brian D. McCarthy

Veritas GRC New York State Department of Financial Services U.S. Securities and Exchange Commission U.S. Commodity Futures Trading Commission

#cybersecurity #cyberriskmanagement #cyberregulation

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7185215705867259904