New cybersecurity requirements for Department of Financial
Services (DFS)-regulated entities took effect on
March 1, 2017. The New York DFS created these requirements in
response to recent or potential threats to sensitive electronic
information, particularly financial information and private
consumer information. EY's report provides an overview of the new
framework with implications for the affected entities. A main goal
is to protect information systems of the affected entities and the
non-public information stored in those systems.
The new cybersecurity requirements include indications for the
below-noted areas. An annual statement certifying compliance with
these requirements must be submitted to the Superintendent by
February 15th. In the context of a M&A transaction,
purchasers considering the acquisition of a DFS-regulated entity
should conduct effective due diligence to ensure the target is in
compliance with these new requirements.
