In recent years, cyber threats have become a growing concern for organizations worldwide. To address these risks, regulatory authorities have implemented cybersecurity regulations to safeguard sensitive data and protect against cyberattacks.
One such example is the New York State Department of Financial Services (NYDFS) Cybersecurity Regulation, which aims to fortify the cybersecurity practices of Covered Entities operating in New York. In this blog, we will explore the key phases of the NYDFS Cybersecurity Regulation and understand the measures organizations must take to comply with this critical cybersecurity mandate.
Phase One: Laying the Foundation (Effective from February 18, 2018)
The initial phase of the NYDFS Cybersecurity Regulation sets the groundwork for a robust cybersecurity policy. Covered Entities are required to develop a comprehensive cybersecurity policy that includes an incident response plan with data breach notifications within 72 hours. These policies must align with industry best practices and adhere to ISO 27001 standards. By covering vital aspects such as information security, access controls, disaster recovery planning, and more, this phase aims to establish a solid foundation for cybersecurity measures.
Phase 2: Reporting Risk Assessment
The second phase of the NYDFS Cybersecurity Regulation focuses on accountability and transparency. Chief Information Security Officers (CISOs) are tasked with preparing an annual report that encompasses the organization’s cybersecurity policies, procedures, and a thorough assessment of cybersecurity risks. Evaluating the effectiveness of current cybersecurity measures is crucial in understanding the organization’s cybersecurity posture and identifying areas for improvement.
Phase Three: Comprehensive Cybersecurity Program (Effective from September 3, 2018)
Phase three is a critical milestone in the NYDFS Cybersecurity Regulation journey. Covered Entities must establish a comprehensive cybersecurity program that aligns with the widely recognized NIST Cybersecurity Framework. This program involves continuous vulnerability assessment, proactive response to cyber threats, and maintaining an audit trail reflecting threat detection and response activities. Additionally, detailed documentation, such as information security policies and guidelines for in-house and third-party applications, ensures that security standards are consistently followed. Moreover, investments in data security controls, encryption, governance, and protection further enhance cybersecurity resilience. Detecting and responding effectively to cybersecurity events, such as data breaches, are essential components of this phase, as is restoring normal operations post-incident.
Phase Four: Managing Third-Party Risk (Effective from March 1, 2019)
In the final phase, the NYDFS Cybersecurity Regulation emphasizes the significance of third-party vendor management. Covered Entities must finalize their policies for third-party vendors with access to their systems. A third-party risk assessment framework is essential to evaluate the security practices of vendors. Furthermore, minimum security requirements, like SOC 2 assurance, must be established for all third-party vendors. Regular assessments of third-party policies and controls ensure that cybersecurity standards are continuously met.
Additional Requirements: Strengthening Cyber Defenses
In addition to the phased implementation, the NYDFS Cybersecurity Regulation includes other essential requirements to enhance cybersecurity defenses. Employing qualified and continuously trained cybersecurity personnel is crucial to manage evolving cyber threats and provide mandatory cybersecurity education and training to employees. Prompt notification of cybersecurity events that may cause significant harm, such as data breaches and leaks, is necessary to mitigate damage. The principle of least privilege is implemented to minimize the risk of certain types of attacks, while multi-factor authentication is adopted to bolster network security. Regular penetration testing is carried out to identify vulnerabilities and reinforce cybersecurity measures. Lastly, the completion of an annual certification process ensures a thorough review of the organization’s cybersecurity program by the board of directors, culminating in a Certification of Compliance with the NYDFS Cybersecurity Regulation.
The NYDFS Cybersecurity Regulation plays a pivotal role in safeguarding sensitive data and fortifying organizations against cyber threats. By adhering to the various phases and requirements outlined in this regulation, Covered Entities operating in New York can establish a strong cybersecurity posture and instill confidence among stakeholders. As the cyber landscape continues to evolve, staying compliant with such regulations becomes more critical than ever, safeguarding both an organization’s reputation and its bottom line.
Keep your company running with a Fully Managed IT Staff!
Growth Mode Technologies offers IT staffing, a focus on cyber security measures and more! Check out our services guide or contact us at sales@growthmodetech.com.
