Deadline To Comply With New York's Cybersecurity Regulation Is Approaching

For entities regulated by the New York Department of Financial Services, the deadline for complying with the new Cybersecurity Requirements for Financial Services Companies, 23 NYCRR Part 500, is Monday, August 28, 2017. To assist, the Department recently updated its Frequently Asked Questions Regarding 23 NYCRR Part 500.

In short, and subject to certain exemptions, the Regulation generally applies to entities required to operate with a license or other formal authorization under New York's Banking Law, Insurance Law, or Financial Services Law. Among other things, the Regulation requires covered entities to:

• Maintain a cybersecurity program, conduct periodic risk assessments, maintain written policies and procedures to protect information systems and nonpublic information, ensure the security of information handled by third parties, designate a Chief Information Security Officer, and conduct training and monitoring.