For those not familiar. The New York State Department of Financial Service (NYDFS) put into place a regulation known as 23 NYCRR 500.

← Back to Blog

For those not familiar. The New York State Department of Financial Service (NYDFS) put into place a regulation known as 23 NYCRR 500. I believe it’s one of the first regulations to sit on a statute to prescriptively address cyber security. It’s up there with regulations like GDPR, the EU NIS directive, CCPA and HIPA in its potential for impact. However it only applies to New York covered entities, AKA those ‘Persons’ operating or required to operate under licence, under banking law. (https://lnkd.in/ee5pG6M)

The NYDFS is prescriptive. It specifically highlights the need for cyber risk assessment, mandates pen testing, monitoring of systems and material financial transactions, designates a CISO and annual board reporting, implementation of appropriate security policies and encryption of non-public data amongst other requirements.

There has been a concerted effort to put in place the mechanisms for oversight, with an enforcement unit established in 2019. I would agree that the foundations are being built and the direction of travel set for enforcement. It’s only a matter of time before it’s tested in court.

So can we expect enforcement to start in 2020, I think so.

Does anyone have any views?

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6631104928322510848