NYDFS Finalizes Significant Amendment To Part 500 Cybersecurity Regulation

On November 1, 2023, the New York State Department of Financial Services ("NYDFS") issued its Second Amendment (the "Amendment") to its Cybersecurity Requirements for Financial Services Companies adopted in 2017, codified in Section 500 of 23 NYCRR 500¹ (the "Cybersecurity Requirements;" the Cybersecurity Requirements as amended by the Amendment, the "Amended Cybersecurity Requirements"). The Amendment imposes significant updates to NYDFS's Cybersecurity Requirements in a statewide effort to bolster safeguards for businesses and consumers by requiring the financial services industry to institute stronger standards and controls to secure sensitive data in order to address the evolving and increasing risks of cyberattacks on holders of sensitive data. Most notably, the Amendment consists of an expansion of obligations on entities regulated by NYDFS to report cybersecurity incidents and enhance their consumer data protection and cybersecurity infrastructure.²