What New Cyber Protocol Rules In New York Mean For Directors And Officers

The New York Department of Financial Services (NYDFS), which is responsible for the regulation of banks, insurers and other financial institutions that do business in New York, is a leader in the United States in putting more responsibility for cybersecurity on the entities it regulates and their respective directors and officers.

New rules developed by the NYDFS under 23 NYCRR Part 500 (the Regulation), which went into effect on March 1, 2017, require such entities within DFS's regulatory jurisdiction to implement specific cybersecurity protocols. These include the enactment of a comprehensive cybersecurity policy, a written incident response plan that reports breaches within 72 hours to the NYDFS, and security policies for third-party service providers who access nonpublic information. The new rules also put more responsibilities on directors and officers, requiring not only the designation of a chief information security officer (CISO) but also board certification to the NYDFS of compliance with the regulations.

The Regulation requires the CISO to prepare an annual report to the board of directors of the regulated entity regarding its cybersecurity program. The report must (1) specifically address the identification of material cyber risks to the regulated entity, including any past material cybersecurity event and (2) report on any penetration testing and vulnerability assessments. The Regulation also requires reporting on multifactor authentication and cyber awareness training for all personnel.

Further, the first compliance certification from the directors and officers of covered entities must be submitted to the NYDFS by February 15, 2018. The Regulation requires that a "Certification of Compliance" be...