The Dawning Of NYDFS Cybersecurity Regulation Enforcement

The New York Department of Financial Services ("NYDFS") has commenced its first enforcement action under New York's Cybersecurity Requirements for Financial Services Companies.¹ Part 500, which requires financial institutions subject to NYDFS jurisdiction to establish and maintain certain cybersecurity standards to protect Nonpublic Information ("NPI") within their control, has been described as a "first in the nation" regulation due to its detailed cybersecurity obligations. NYDFS has prioritized compliance with Part 500 in regular and targeted examinations of NYDFS-supervised institutions, and now has taken the next step in an enforcement action against First American Title Insurance Company.