New York DFS Cyber Rules Go Live: Here’s Your Roadmap

August 28, 2017 marks the end of the initial 180-day grace period for compliance under the New York Department of Financial Services’ “first-in-the-nation” cybersecurity regulations (the “Rules”).  The initial regulations were proposed last year, but NY DFS received robust public comments that led to significant amendments.  While the proposed regulations set out proscriptive, one-size-fits-all requirements, the final Rules align more closely to flexible federal, financial sector guidance, captured in the NIST cybersecurity framework and the FFIEC cybersecurity assessment tool.  Accordingly, the final Rules require that cybersecurity programs be calibrated to periodic “risk assessments” that give entities discretion to specify the criteria used to identify, evaluate, and remediate risks, in the context of technological developments and corporate controls.

While covered entities are technically required to be in compliance with the Rules as of Monday, there are additional transitional periods for certain items (see below), and entities have until February 15, 2018 to submit their first certifications to NY DFS.  For organizations still working through compliance requirements, the below steps may help to prioritize and implement a work plan.

Step 1: Do the Rules Apply to Us?  Are we Exempt?
The Rules apply to Covered Entities, which include any entity “operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law.”[1]

If an organization is a Covered Entity, then it should assess whether “limited exemptions” apply pursuant to section 500.19.  These exemptions alleviate the need to comply with certain (but not all) provisions of the Rules in specified situations.  For example, the Rules exempt Covered Entities from potentially expensive requirements relating to penetration testing, application security, multi-factor authentication, encryption, and incident response planning if they have (1) fewer than 10 employees, or (2) less than $5,000,000 in gross annual revenues in each of the last 3 fiscal years, or (3) less than $10,000,000 in year-end total assets, including assets of all Affiliates.

Finally, Covered Entities should ensure that compliance is executed from an enterprise perspective.  If any subsidiaries or affiliates of a Covered Entity present risks to the Covered Entity’s systems, or to nonpublic information stored on those systems, then “those [subsidiary or affiliate] risks must be evaluated and addressed in the Covered Entity’s Risk Assessment, cybersecurity program and cybersecurity policies.”[2]

Step 2: What is the Timing for Compliance? Are there Transitional Deadlines?
Covered Entities should be mindful that while the initial 180-day transitional period for compliance has ended, there are other transitional periods and critical checkpoints for submissions to NY DFS and certifications.[3]

23 NYCRR Part 500	Key Dates
500.21	March 1, 2017 – 23 NYCRR Part 500 becomes effective.
500.22 (a)	August 28, 2017 – 180 day transitional period ends. Covered Entities are required to be in compliance, unless otherwise specified (see 500.22 transitional periods below)
500.19 (e)	September 27, 2017 – Initial 30 day period for filing Notices of Exemption ends. Covered Entities that qualify for a limited exemption as of August 28, 2017, must file a Notice of Exemption on or prior to this date.
500.17 (b)	February 15, 2018 – Covered Entities are required to submit the first certification under 500.17(b) on or prior to this date.
500.22 (b)(1)	March 1, 2018 – One year transitional period ends. Covered Entities are required to be in compliance with sections 500.04(b), 500.05, 500.09, 500.12 and 500.14(b)
500.22 (b)(2)	September 3, 2018 – Eighteen month transitional period ends. Covered Entities are required to be in compliance with sections 500.06, 500.08, 500.13, 500.14(a) and 500.15
500.22 (b)(3)	March 1, 2019 – Two year transitional period ends. Covered Entities are required to be in compliance with 500.11

To perform a gap assessment between an organization’s current posture and the Rules, the requirements should be organized and prioritized. Below, we have (re)organized the Rules into six broad categories and provided compliance deadlines for each category.  Using a matrix like this can facilitate planning, allocation of work flows, and tracking of progress toward full compliance.

Deadline	Category / Section / Requirement Topic
(A) Personnel
28-Aug-2017	500.04(a) - Chief Information Security Officer (CISO)
1-Mar-2018	500.04(b) - CISO's Reports to the Board
28-Aug-2017	500.10 - Cybersecurity Personnel and Intelligence
1-Mar-2018	500.14(b) - Training and Monitoring (Policies)
(B) Security Program and Policies
28-Aug-2017	500.02 - Cybersecurity Program
28-Aug-2017	500.03 - Cybersecurity Policies
28-Aug-2017	500.16 - Incident Response Plan
28-Aug-2017	500.17 - Notices to Superintendent ("Cybersecurity Events")
3-Sep-2018	500.08 - Application Security
3-Sep-2018	500.13 - Limitations on Data Retention
(C) Ongoing Risk Assessment / Testing
1-Mar-2018	500.09 - Risk Assessment
1-Mar-2018	500.05 - Penetration Testing and Vulnerability Assessments
(D) Technical Measures
28-Aug-2017	500.07 - Access Privileges
1-Mar-2018	500.12 - Multi-Factor Authentication
3-Sep-2018	500.14(a) - Training and Monitoring (Tools)
3-Sep-2018	500.15 - Encryption of Nonpublic Information
(E) Audit Trail / Recordkeeping, Reporting
3-Sep-2018	500.06(a) - Audit Trail
28-Aug-2017	500.06(b) - Audit Trail (Retention Requirements)
15-Feb-2018	500.17 - Notices to Superintendent (Annual Certifications)
(F) Third Party Vendor Management
1-Mar-2019	500.11 - Third Party Service Provider Security Policy

The intent of the NY DFS rules is to create an approach that will help entities benchmark against their current security postures, to prioritize investments of time and resources, and to operationalize self-(and vendor-) reviews and improvement processes. In addition, the specific emphasis on prompt incident reporting (i.e., within 72 hours of determining that a cybersecurity event has occurred) and the extensive requirements for third-party vendor management, will require covered entities to significantly “up their game” on security.

However, it is important to remember that cybersecurity is about risk management, not risk avoidance.  And while rules, frameworks and standards are always useful guidance, “real security” is about an iterative process and culture that helps a company to identify and remediate risks – and to understand where residual risk remains.  Thus, entities should avoid the temptation to “manage to the Rules,” and view them as a complementary reference point in the organization’s overall security toolbox.

---

[1] 23 NYCRR 500.01.

[2] See FAQ #3, available at http://www.dfs.ny.gov/about/cybersecurity_faqs.htm.

[3] See “Key Dates under New York’s Cybersecurity Regulation,” available at http://www.dfs.ny.gov/about/cybersecurity.htm.