New York And Illinois Regulators Recommend Third Party Cybersecurity Review For Specific Vulnerabilities

This month, the Illinois Department of Insurance issued guidance to insurers recommending assessments in response to a Microsoft Exchange vulnerability, detailed in the guidance.  In the Bulletin dated May 5, the Department encourages regulated entities to "assess the risk to their systems and consumers and take steps necessary to address vulnerabilities and customer impact." The Bulletin states that such assessment should identify "any use of these products by critical third parties."

The Illinois Bulletin follows similar guidance from the New York Department of Financial Services (NYDFS) regarding Microsoft Exchange and SolarWinds' vulnerabilities:

• In an "Industry Letter" issued in March, the NYDFS discussed Microsoft Exchange vulnerabilities and encouraged regulated financial companies to identify "any use of these products by critical third parties" as part of mitigation.