NYDFS Issues Guidance On Cybersecurity Controls To Combat Ransomware And Clarifies Reporting Obligations

The New York Department of Financial Services (NYDFS) issued new guidance this week intended to assist organizations in thwarting ransomware attacks. The guidance clarifies the NYDFS' expectation that NYDFS-regulated companies should "implement these controls whenever possible" and report any successful deployment of ransomware or unauthorized access to privilege accounts to the NYDFS under its established cybersecurity event reporting regulations. This guidance comes at an inflection point for cybersecurity and ransomware, as "the rate of ransomware attacks increased 300% in 2020," as recently noted by Homeland Security Secretary Alejandro Mayorkas and as NYDFS continues to focus on the silent and systemic risks posed by ransomware to the financial services sector. In connection with releasing its guidance, the NYDFS warned that ransomware attacks "could cause the next great financial crisis" and "lead to a loss of confidence in the financial system." Below we