Cybersecurity: Who Can Certify Compliance To The NYDFS

The New York State Department of Financial Services (NYDFS) Cyber Security Regulation for Financial Services Companies 23 NYCRR 500, enacted in March 2017 (the "Regulation"), sets out the required framework for regulated entities' information security programs. The NYDFS Cybersecurity Regulation applies to "Covered Entities," which are organizations required to operate under NYDFS authorization pursuant to the New York Banking Law, the Insurance Law, or the Financial Services Law¹.

The Regulation requires Covered Entities to engage in specific cyber assessment activities, including all of the following:

• assess their specific risk profile;
• develop a written incident response plan;