Privacy, Cyber & Data Strategy / Privacy & Cybersecurity Litigation Advisory: NYDFS Finalizes Second Amendment To Its Cybersecurity Regulation

Executive Summary

Our Privacy, Cyber & Data Strategy and Privacy & Cybersecurity Litigation teams examine the New York Department of Financial Services' finalized Second Amendment to its Cybersecurity Regulation.

• The regulations expand on when cybersecurity events require notice to NYDFS – including after deployment of ransomware and extortion payments
• Covered entities must expand their use of multi-factor authentication, maintain an asset inventory, and operationalize policies through developed procedures
• Senior officers must have sufficient knowledge to oversee the company's cybersecurity program, and both the CISO and highest ranking executive must certify compliance annually