Morgan Lewis Urges NYDFS To Modify Proposed Cybersecurity Rules

The New York Department of Financial Services has issued proposed "first-in-the-nation" cybersecurity rules that could place a heavy compliance burden on affected financial companies; Morgan Lewis submitted a comment letter urging that several of the proposals be modified.

On September 13, the New York State Department of Financial Services (NYDFS) issued proposed cybersecurity rules that would require banks, insurers, and other NYDFS-regulated financial services companies to adhere to stringent cybersecurity requirements mandating firms to, among other things, test their systems, establish plans to respond to cybersecurity events, and annually certify compliance with the cybersecurity requirements, among other mandates (Proposed Rules). The NYDFS described the Proposed Rules as "a new first-in-the-nation regulation."¹