New York State Releases Final "First-In-Nation" Cybersecurity Rules

Introduction

The New York Department of Financial Services ("DFS") recently released the much-anticipated final version of its "first-in-nation" cybersecurity rules that it first announced in the fall of last year.¹ The rules require a wide range of insurance, banking, and financial services companies to adopt robust cybersecurity programs to protect sensitive and confidential data from theft or harm by cybercriminals.

This is the second, and final, time that DFS has revised the cybersecurity rules. We previously have summarized the key provisions of the rules after their initial revisions.² This final round of revisions clarifies (i) which cybersecurity events are subject to a notice requirement, (ii) the amount of time that entities are required to maintain records related to cybersecurity events, and (iii) when certain exemptions to the rules apply. Ultimately, however, the revised rules retain the rigorous new cybersecurity requirements imposed by the