NYDFS Revises Its Proposed Amendments To Cybersecurity Regulations

As we reported in a previous blog post, the New York Department of Financial Services ("NYDFS") proposed a raft of amendments to its landmark Cybersecurity Regulations (the "Regulations") in 2022 (the "2022 Proposed Amendment"), adding substantial complexity to covered entities' compliance obligations. Now, less than a year later, the NYDFS has published a proposed revised draft of the 2022 Proposed Amendment (as revised, the "2023 Proposed Amendment"). While not as extensive as the 2022 Proposed Amendment, the 2023 Proposed Amendment will nevertheless have a significant impact on how your organization complies with the Regulations.

Definition of Class A Companies

The 2022 Proposed Amendment established a definition of "Class A Companies" that would include the largest Covered Entities (i.e., those with more than 2,000 employees averaged across the last 2 fiscal years, including the Covered Entity and affiliates, and those with more than $1,000,000,000 in gross