Call us now:
For those cyber security professionals that have been or are in financial services, with offices located in New York. Or those that want to evaluate what a financial services regulation looks like, following closely on the heals of the SEC final rule. The enclosed should be read. The New York Department of Financial Services has updated its cybersecurity risk management regulation as of the 1st November 2023. That has some similarities tot he SEC final cyber rule.
There’s to much to discuss, additions are underlined in the document. Some observations include.
1. The scope has been significantly increased. In ones opinion covering Rep offices, no matter where there parent is located.
2. Cyber incident reporting includes the covered entity, its affiliates and third party supplier.
3. Covered entities must assess and report material cyber risks and material cyber incidents. Analogous to the SEC final rule.
4. Cybersecurity audits shall be conducted based upon risk.
5. The CISO shall report material cybersecurity issues to the governing body of the covered entity.
6. The covered entity must have a complete and managed asset inventory.
7. The entities highest ranking executive and the CIOS will certify compliance to the regulation.
8. If a covered entity complies it will certify compliance, including documentation of officers, employees, representatives, outside vendors, reports, certifications. Or write it does not comply, and include a remediation timeline.
9. Provide periodic, but at a minimum annual, cybersecurity awareness training, updated to reflect risks identified by the covered entity.
10. In assessing violation penalties the regulator will consider amongst many things the extent to which relevant policies and procedures are consistent with cybersecuirty frameworks such as NIST.
NYDFS appears to have aligned material cybersecurity risk management and material incident discloser compliance with the SEC final cyber rule. Placed the CISO as an certifying authority to the regulation, and made clear that all data used to certify compliance can be discoverable in certifying compliance and must be kept for 5 years.
Given the recent case raised by the SEC against SolarWinds and the discovery process followed, that identified data used to charge the company and CISO. One suggests cyber regulation in the U.S is going through harmonisation. Placing more focus on the role of the CISO for the management of cybersecurity risk.
Ted Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA Bob Dix
#paravasecuritysolutions #cybersecurity #cyberriskmanagement #nydfs
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7125927333575712768