New York State Revises "First-In-Nation" Cybersecurity Rules

INTRODUCTION

The New York Department of Financial Services ("DFS") recently issued a revised version of the cybersecurity rules¹ that it first announced in the fall of last year.  The rules apply to a wide range of insurance, banking, and financial services companies under the DFS's supervision and require them to adopt robust cybersecurity programs to protect sensitive and confidential data from theft by cybercriminals.  Although the revised rules appear to incorporate some of the comments made by the public and industry groups during a notice and comment period in the fall, they still impose a number of rigorous new cybersecurity requirements that will affect not just companies regulated by the DFS but many of the third party service providers who have access to confidential corporate data or systems.  The new rules also leave open the question as to whether the DFS will bring enforcement actions against covered entities – and potentially their employees – for