Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

On November 1, the New York Department of Financial Services (NYDFS) adopted a<a> </a><a href="https://www.dfs.ny.gov/system/files/documents/2023/10/rf_fs_2amend23NYCRR500_text_20231101.pdf" target="_blank" rel="noreferrer noopener">second amendment</a> to its cybersecurity regulations (Amendment). These regulations focus on a broad range of issues, from data breach response to information governance to cybersecurity controls. The Amendment’s requirements enter into force on a rolling basis, with changes to reporting requirements taking effect December 1, 2023, and other key obligations entering into force starting on April 29, 2024.

contentpilot/introduction

Ransomware, Extortion, and Data Breach Response

core/heading

Pursuant to the Amendment, covered entities must notify <a>NYDFS </a>of a qualifying “cybersecurity incident” within 72 hours, whereas the previous regulation included notification requirements for “cybersecurity events.”

core/paragraph

The original NYDFS cybersecurity regulation defined a “cybersecurity event” as “any act or attempt, successful or unsuccessful, to gain unauthorized access to, disrupt or misuse an information system or information stored on such information system.” The Amendment creates a new term, “cybersecurity incident,” which it defines as:

[A] cybersecurity event that has occurred at the covered entity, its affiliates, or a third-party service provider that: (1)&nbsp;impacts the covered entity and requires the covered entity to notify any government body, self-regulatory agency or any other supervisory body; (2) has a reasonable likelihood of materially harming any material part of the normal operation(s) of the covered entity; or (3) results in the deployment of ransomware within a material part of the covered entity’s information systems.

Accordingly, covered entities must report to the NYDFS certain cybersecurity incidents by which they are directly impacted and those impacting their affiliates or third-party service providers.

Further, each covered entity is required to “promptly” furnish the superintendent, upon request, with “any information” regarding the cybersecurity incident, and each has a “continuing obligation to update the superintendent with material changes or new information previously unavailable.”

Moreover, in situations involving extortion payments, a covered entity must notify the superintendent within 24 hours of such payment being completed. Subsequently, within 30 days of the payment, a covered entity must submit to the superintendent a written description of why the payment was deemed necessary, any alternative measures considered, all efforts to find alternatives to such payment, and all diligence performed to ensure compliance with other applicable rules and regulations, including export control laws.

Incident Response and Business Continuity Planning

Each covered entity is required to implement and maintain a written incident response plan (IRP) that sets forth its proactive measures to investigate and mitigate cybersecurity events and ensure operational resilience, including but not limited to incident response, business continuity, and disaster recovery plans. The Amendment expands the content requirements so a covered entity must ensure its IRP now addresses its backup recovery process and how it will prepare a root cause analysis that describes how and why the cybersecurity event occurred, what business impact it had, and what will be done to prevent reoccurrence.

The Amendment includes several business continuity and disaster recovery (BCDR) obligations. Specifically, a covered entity is required to adopt a BCDR plan that “shall be reasonably designed to ensure the availability and functionality of the covered entity’s information systems and material services and protect the covered entity’s personnel, assets and nonpublic information in the event of a cybersecurity-related disruption to its normal business activities.” A BCDR plan must:

core/list

Each covered entity shall periodically, but at least annually, test its IRP and BCDR plan with all staff and management critical to the response and revise the plans as necessary and test its ability to restore critical data and information systems from its backups.

Class A Companies and Cybersecurity Controls

The Amendment defines “Class A companies” as NYDFS-regulated businesses that either have over 2,000 employees or over $1 billion in gross annual revenue, in each case including the company’s affiliates. A Class A company must conduct a “risk assessment” at least annually or whenever the business or technology causes a material change in cyber risk and design and conduct an independent audit of its cybersecurity program based on its risk assessment. It must implement a privileged access management solution as well as methods for automatically blocking commonly used passwords. It must also implement endpoint detection tools and other solutions to monitor and log potentially unauthorized activity.

<a>The Amendment </a>also sets forth additional cybersecurity controls applicable in certain circumstances, such as those related to encryption, vulnerability management (e.g., annual penetration and security testing and scanning), access management controls, and asset inventory.

The Amendment also requires a covered entity to implement multifactor authentication for individual access to any of its information systems. In the case of an exempt entity, multifactor authentication must be used for remote access to both its information systems and third-party applications, as well as all “privileged accounts other than service accounts that prohibit interactive login.”

In addition to the annual report previously required under the regulation, a covered entity’s chief information security officer (CISO) is now required to report to its senior governing body on material cybersecurity issues, including “significant cybersecurity events and significant changes to the covered entity’s cybersecurity program.”

Although the original regulation already required <a>a covered entity’s senior governing body </a>to have sufficient knowledge or be advised by persons with sufficient expertise and knowledge to oversee cyber risk, the Amendment adds requirements that the senior governing body also provide oversight of and direction for the entity’s cyber risk management program, including providing sufficient resources for program management.

By April 15 of each year, a covered entity is required to provide the superintendent with one of the following:

The certification or acknowledgment must be signed by the covered entity’s highest-ranking executive and its CISO. If the covered entity does not have a CISO, the certification or acknowledgment must be signed by the highest-ranking executive and the senior officer responsible for the covered entity’s cybersecurity program.

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2023/11/Privacy-Cybersecurity-Update-NYDFS-Amends-Data-Breach-and-Cybersecurity-Regulations.pdf

NYDFS Amends Data Breach and Cybersecurity Regulations

Services