{"id":3761,"date":"2024-04-03T14:19:24","date_gmt":"2024-04-03T18:19:24","guid":{"rendered":"https:\/\/www.amalgamatedbenefits.com\/amalgamated-life\/?p=3761"},"modified":"2024-04-03T14:19:26","modified_gmt":"2024-04-03T18:19:26","slug":"the-new-york-department-of-financial-services-finalizes-cybersecurity-regulations","status":"publish","type":"post","link":"https:\/\/www.amalgamatedbenefits.com\/amalgamated-life\/the-new-york-department-of-financial-services-finalizes-cybersecurity-regulations\/","title":{"rendered":"The New York Department of Financial Services Finalizes Cybersecurity Regulations"},"content":{"rendered":"
\"The<\/figure>\n

On November 1, 2023, the New York Department of Financial Services (NYDFS) issued the finalized revisions to the NYDFS Cybersecurity Regulations, which represent the Second Amendment to 23 NYCRR Part 500. Viewed as the most significant modifications to Part 500 since the regulations were first enacted in 2017, they establish new requirements for NYDFS-regulated covered entities. Part 500 defines covered entities as \u201cany person operating under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or Financial Services Law, regardless of whether the covered entity is also regulated by other government agencies.\u201d It is important for these covered entities to understand the amended regulations and to take the appropriate measures to ensure their compliance. The NYDFS has already indicated that certain changes will require many entities to make substantial enhancements (and related investments) to their current cybersecurity measures. Additionally, it has forewarned that there will be an increase in its investigation and enforcement actions related to its amended cybersecurity regulations which some believe will be adopted by other federal and state agencies.<\/p>\n

Steps to Take<\/h2>\n

Covered entities should start by reviewing their current cybersecurity initiatives to assess system weaknesses. Penetration testing and vulnerability assessments should be performed by an experienced third party cybersecurity firm or a qualified internal information technology (IT) staff member, rather than a managed service provider. They should then take the necessary measures to mitigate any vulnerabilities and to leverage any new technologies that support the highest level of cybersecurity. Finally, a review and understanding of all the new components in the Second Amendment to Part 500 should be noted and shared with all officers of the company, members of the IT staff and any outside vendors performing maintenance or other services to the organization\u2019s IT systems.<\/p>\n

Second Amendment Requirements<\/h2>\n

Below is a breakdown of the new requirements under then NYDFS Cybersecurity Regulations Second Amendment:<\/p>\n