New York DFS Issues Revised – And Still Demanding – Cybersecurity Regulations

On December 28, the New York Department of Financial Services issued revisions to the extensive and detailed cybersecurity regulations for licensed banks and insurance companies, which DFS first announced in September 2016 (proposed 23 NYCRR Part 500). The revised regulations are an improvement over the earlier release. They provide some flexibility for a company to forego a security practice that the regulations endorse, but that is unnecessary to contain risk. They also narrow the types of data that must be protected. In addition, they extend the phase-in to two years and acknowledge the necessity of confidentiality safeguards for information that DFS requires businesses to submit to it.