NYDFS Issues Guidance On Multi-Factor Authentication

The New York Department of Financial Services (NYDFS) continues to refine its position regarding the importance of and requirements regarding Multi-Factor Authentication (MFA), as evidenced most recently with the release of new guidance. This new guidance is consistent with its June guidance, in which NYDFS clarified its expectation that NYDFS-regulated covered entities subject to 500.12 implement MFA for any individual accessing the covered entity's internal networks, externally exposed enterprise applications, and third-party applications from an external network.

The June guidance was released when the rate of ransomware attacks was rapidly increasing and reflected NYDFS concerns regarding ransomware's potential to destabilize the financial system. Now, NYDFS has identified the lack of MFA as a specific and significant weakness of financial organizations and further clarifies its explicit requirement for this "essential control."