New York Strengthens Data Retention & Disposal Requirements

Recent amendments to the New York Department of Financial Services 23 NYCRR Part 500, which more than a half-decade ago transformed cybersecurity compliance for thousands of insurance, financial services and healthcare organizations, threaten to shake things up again by adding new requirements. Joseph Shepley of Alvarez & Marsal offers guidance to CISOs at covered organizations.

The New York Department of Financial Services' 23 NYCRR Part 500 has been a part of the compliance landscape for insurance, financial services and healthcare organizations since 2017. Part 500 has transformed the cybersecurity posture of these covered entities, benefiting consumers, employees and other data subjects whose personal data organizations process.