New York Finalizes Cybersecurity Regulations For Financial Institutions

On February 16, the New York State Department of Financial Services (NYDFS) issued cybersecurity regulations for banks, insurance companies and other financial institutions subject to NYDFS jurisdiction. The regulations, which take effect March 1, 2017, are available here. Entities subject to the regulations will have 180 days from the effective date to come into compliance with most requirements, though certain provisions allow up to two years after the effective date.¹

First proposed in September 2016 and revised after two rounds of public comment, the regulations establish requirements that in some respects duplicate federal data security obligations for financial institutions, but in some important respects differ from and go beyond federal requirements. Notably, the NYDFS regulations rely on a definition of "Nonpublic Information" that must be protected that is considerably broader than the definition of "customer information" under the federal