Report Highlights Bank Vendor Cybersecurity Vulnerabilities

On April 9, the New York State Department of Financial Services (NYDFS) released a report on bank vendor cybersecurity that highlights the risk that hackers will use third-party service providers to gain access to bank data. The report, entitled Update on Cyber Security in the Banking Sector: Third Party Service Providers,¹ is based on responses to an October 2014 NYDFS information request to 40 regulated financial institutions and is significant for at least two reasons. First, the report may be useful for benchmarking a company's cybersecurity practices against similarly situated businesses. Second, the report may become the basis for NYDFS to promulgate new cyber regulations for third-party vendors—particularly with regard to the representations and warranties banks receive about cyber protections—in the coming weeks.²