US regulators usually issue cybersecurity guidance instead of
regulator standards and requirements. That changed on March 1,
2017, when the Superintendent of New York's Department of
Financial Services (NYDFS) exceeded federal efforts and put into
effect Cybersecurity Requirements for Financial Services Companies
(Cybersecurity Regulation).
Following a spate of cyber-attacks and breaches of customer
confidentiality, the NYDFS declared that for certain financial
institutions operating in New York "regulatory minimum
standards are warranted". Although this edict directly applies
only to banks, insurance companies and other financial services
institutions specifically regulated by the NYDFS, (i.e., with
operations subject to the jurisdiction of the NYDFS), financial
institutions are finding that the requirements may apply indirectly
to foreign headquarters and branches located throughout the
world.
