Upcoming New York State Cybersecurity Regulation Deadlines

As a reminder, entities covered by the New York State Department of Financial Services' (NYSDFS) Cybersecurity Regulations (23 NYCRR Part 500) (Cybersecurity Regulations) are required to submit their annual certification of compliance for calendar year 2018 no later than February 15, 2019. In addition, the last transitional period of the regulations will end on March 1, 2019, after which covered entities will need to comply with the third-party service provider provisions.

What Is Required for the Annual Certification?

The certification requires a member of the board of directors or a senior officer responsible for the management, operations, security, information systems, compliance and/or risk of the entity to attest that the board of directors or the senior officer has reviewed the entity's policies and documentation required under the Cybersecurity Regulations and, to the best of their knowledge, the entity's cybersecurity program was in compliance with the Cybersecurity Regulations' requirements during the past calendar year. Instructions for filing the certification with NYSDFS are available here.

Importantly, if during its annual certification review of the policies and procedures required by the Cybersecurity Regulations, a covered entity identifies areas, systems or processes that require "material improvement, updating or redesign," then the entity must document the "identification and the remedial efforts planned and underway to address such areas, systems or processes" and maintain such documentation for potential inspection or review by NYSDFS.

What Requirements Go Into Effect on March 1, 2019?

March 1, 2019, ends the final transitional period of the Cybersecurity Regulations, after which covered entities must comply with all of the requirements. As of this date, covered entities must have written policies and procedures in place that are designed to ensure the security of its information and systems accessible to, or held by, third-party service providers. These policies and procedures must include: (1) the identification and risk assessment of all providers; (2) minimum cybersecurity practices required to be met by the providers in order to do business with the covered entity, including their...