Call us now:
Covered entities of the New York Department of Financial services (NYDFS) face stricter cyber security regulations. Proposals released at the end of July 2022 ended a pre-proposal comment period on the 8th August, pending the publication of official amendments that will start a 60 day comment period. Some industry sectors that are concerned about incident reporting deadlines, may wish to consider the NYDFS proposal.
1. Notify the NYDFS electronically no later than 72 hours after a cybersecurity event that resulted in the deployment of ransomware within a material part of the covered entitys information systems;
2. Notify the NYDFS within 24 hours of an extortion payment being made in connection with a cybersecurity event.
Other requirements include
1. An annual risk assessment of the covered entity.
2. The BoD to sign off cyber policies.
3. The BoD to possess sufficient cybersecurity knowledge or employ an advisor.
4. Develop an implement a cybersecurity program
5. Conduct an annual independent audit of its cybersecurity program.
6. Retain an external auditor to conduct a cybersecurity risk assessment at least once every three years;
7. Perform at least weekly system scans or reviews as well as the currently required bi-annual vulnerability assessments;
All of which have some similarities with the SEC cyber proposal, SoX, EU NIS and DORA (provisional) Ted Dziekanowski
#cybersecurity #cyberriskmanagement #theaugstagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6971397593184542720