Five New Requirements Under New York DFS Cybersecurity Regulation Go Into Effect On September 1, 2018

On September 1, 2018, five new requirements included in the New York State Department of Financial Services' (DFS) Cybersecurity Regulation go into effect – (1) audit trails, (2) application security, (3) data disposal requirements, (4) monitoring authorized users' activity, and (5) encryption of nonpublic information. Of these, the requirement to encrypt nonpublic information when held at rest or transmitted over external systems may be the most burdensome for businesses. Entities that fall within the Regulation's limited exemption provided in Section 500.19(a) (e.g., fewer than 10 employees, less than $5 million in gross annual revenue for last three years, or less than $10 million in year-end total assets) are exempt from complying with any of these provisions, aside from the data disposal requirement. All other covered entities are expected to be in compliance as of September 1.