New York State Cyber Security Regulations Mandate Common-Sense Practices

New York State Cyber Security Regulations for Financial Institutions Could Be Model for Other States

The first phase of the New York state cyber security regulations, which apply to insurance companies, banks, and other financial institutions operating within the state, finally went into effect on March 1.

While the insurance and finance industries are already highly regulated, New York’s legislation is the first at the state level to mandate specific cyber security requirements. While there is some overlap with existing regulations and standards, the requirements under New York’s law are very specific. However, there’s nothing Earth-shattering about the requirements; they consist of common-sense, proactive cyber security practices that all organizations should already be adhering to. Because of this, and the international reach of the finance and insurance organizations it applies to, it is expected to be a model for other states.

Requirements of the New York State Cyber Security Regulations

The new law is 14 pages long and contains 23 sections; you can download a PDF copy of it here. Among other things, organizations must:

• Design and implement a cyber security program based on a comprehensive risk assessment. Among other requirements, the program must address the organization’s plan to detect and respond to “Cybersecurity Events,” “recover from Cybersecurity Events and restore normal operations and services,” and “fulfill applicable regulatory reporting obligations.” The cyber security program must also establish secure development procedures for applications developed in-house.
• Implement and maintain a written cyber security policy. The policy must be based on the risk assessment and include “policies and procedures for the protection of [the organization’s] Information Systems and Nonpublic Information stored on those Information Systems.”
• Design and maintain a written cyber security incident response plan.
• Provide all employees with ongoing cyber security awareness training.
• Designate a Chief Information Security Officer (CISO). The organization may hire its own CISO or use a third-party service provider to fulfill this function.
• Perform penetration testing, vulnerability assessments, and periodic risk assessments.
• Maintain audit trails.
• Establish appropriate system user access privileges.
• Employ “qualified cybersecurity personnel” to perform cyber security-related functions. Third-party personnel may be substituted for in-house employees. Importantly, the law requires that these personnel be provided with ongoing training so that they stay current in their field.
• Establish a separate cyber security policy for third-party service providers.
• Utilize multi-factor authentication and data encryption.

The law also contains reporting, notification, and confidentiality requirements, as well as certain exemptions for organizations with fewer than 10 employees, less than $5 million in gross annual revenues, and less than $10 million in assets.

Complying with the New York State Cyber Security Law

Most banks, other financial organizations, and insurance agencies in the state of New York have six months from March 1 to implement the first phase of the law, including the cyber security policy, employee training program, and incident response program. Despite the law’s exemptions for smaller firms, many finance and insurance organizations are worried about their ability to comply with the new law. There is a significant cyber security skills gap, which has already driven salaries through the stratosphere – assuming an organization can even find qualified talent to begin with. Now that multinational Wall Street finance companies are expected to begin aggressively recruiting security analysts and engineers, the talent pool will shrink even further, and labor costs will rise even higher.

The new law is quite complex, and the penalties for non-compliance are very high. Now more than ever, firms affected by the New York law need to (1) Make use of RegTech software such as Continuum GRC’s IT Audit Machine (ITAM) to automate their governance, risk, and compliance functions and (2) Outsource their cyber security to a qualified third-party provider such as Lazarus Alliance.