NYDFS Security Regulation FAQ

Rick: In 2016, the New York Department of Financial Services (NYDFS) issued a cybersecurity regulation that went into effect in 2017 and covered entities, which are insurance companies, insurance brokers, producers, agents, and a variety of other entities, New York state-chartered banks, check cashing companies, etc. In 2021, they started enforcing it and fined a number of companies on consent orders with remediation plans and programs that were intense. 

Ron: The NYDFS standards are specific. For example, the 23 NYCRR part 500 is fairly comprehensive. It is one of the first standards that specified a qualified chief information security officer (CISO). NYDFS expects there to be somebody who can manage the security program for the organization, somebody with the right experience from a technical perspective, with the right experience from a business executive perspective, somebody that can marshal the organization to be in the best state of protection of their data. The CISO has to give a report to the board and not just a committee. This requirement is being replicated in regulations like GLBA (Gramm-Leach-Bliley Act) and DOL (Department of Labor), and the SEC (Securities and Exchange Commission) will most likely follow.

One of the main commonalities in these regulations is multifactor authentication. You will also see this requirement in your application for cyber insurance. By creating a more robust monitoring perspective or a more robust dynamic defense methodology, it will put you in a better position to encounter things that maybe in the past have been difficult to do. For example, we’re working with an organization that was a victim of a zero-day exploit. There wasn’t a counter security patch that was available to a particular specific system on the edge. Without a defense-in-depth monitoring methodology, it’s very difficult to combat. Bad actor groups will exploit those edge devices more and more to the point where they might even be trying to look for their own zero days and using those to make a big score. Without defense-in-depth monitoring, you can fall victim to zero day, which we’re going to see more and more.

Ron: The fortunate thing is that there are some commonalities with this, so we don’t have agencies that are developing and implementing their own interpretation of what should be done. We’re seeing things, like basic things, and reiterating some of the basic things that comprise a security program, like a risk assessment. Do your risk assessment, know what you have, know who wants it, and know what really is at risk so you know how to protect it. That helps your organization to ensure you’re allocating the right level of investment as well, starting with that risk assessment. 

Then, it gets tactical. There are a lot of requirements about things like multifactor authentication. It’s been recognized that a password is no longer good enough. Having another factor that can validate your identity is going to be something that is very important. Try getting cyber insurance without multifactor these days! 

From a procedural incident response standpoint, they’re putting in specifications about having an incident response plan. Some standards are even creating timelines to notify within a certain amount of time. Those are some of the commonalities. And it’s really all wrapped around one of the things I’m glad to see is happening and that’s there’s more of a pronounced demand — or I should say expectation — for a security competency in-house or even brought from the outside that can really bring that security experience to bear. And then, understand the interpretation of all these guidelines and really create efficiency and effectiveness and make sure security is really driven in a coordinated way.

Rick: First, you’re going to have to have a good cybersecurity program, and you’re going to have to look carefully at how that maps to the regulations.  We don’t know exactly yet what all of it will be, but it appears that they want to have something top level, and they are, for example, requiring multifactor authentication. They are requiring some sort of detection and response, and it may be managed detection and response to be in place. It isn’t entirely clear yet, but we can see where it’s going, and sophistication is key.

Ron: Yeah, another commonality, and the SEC is no exception, is the requirement for good policies and procedures. At times, organizations can look at this as a very rote exercise. It’s just documentation, let’s put words on paper and let’s just say, hey, we got that, let’s check the box. Where good policies, procedures, and standards are really going to create where the policy says, here’s the cake we’re trying to bake, the standards will say, these are the ingredients, meaning this is how we’re going to measure and making sure the outcome of what we’re trying to do to make ourselves secure, that we put the right stuff into it. 

Then, the procedures, of course, that’s the recipe. This is how we assemble these ingredients and make sure that we follow this so we drive consistency and continuity, which are very important concepts because you want the control to work the same way every time so long as you deem it to be effective. Over time, it’s going to continue in the same manner. That’s the consistency aspect. The continuity, if key people leave, they tend to take information with them, so we want to make sure that there’s something left behind that others can continue to follow, and then it could be updated if things change, the business changes, technology changes, data changes. Being able to document these things becomes very critical, and then you can start to expand out and do the things that you need to do. What about supply chain risk and managing my vendors appropriately? Do I have control of all my assets? Am I applying what needs to be applied from a security standpoint to the various assets? Am I continuing to monitor my assets to make sure that I can detect, respond, and recover to cyber incidents as they occur? So the SEC is no exception in terms of what they’re laying out. 

Rick: Ron makes great points there. On the policies and the procedures, they do have to be written. They are requiring that there be written policies and procedures and that the controls in those policies and procedures be “effective.” What that means is that you have to test, you have to check. It’s an audit content. Auditors are going to come in, and they’re going to look, and they’re going to ask for screenshots to show that not only is it written on paper but that it’s been implemented and it’s working. And that is another level of assurance to make sure that things are happening the way that they’re supposed to happen. That is something that is going to be there and that these companies are going to have to get used to because there’s a lot of work to be done in that.

Ron: GLBA already had regulations in the past, but now they’re more specific in that they want to see you be more prescriptive, like an inventory and classification of your data. Additional requirements may be specifying secure development and conducting application testing. The NYDFS has already been doing this. Some of these specific requirements are now really standing out. For example, the requirement is no longer just a penetration test on an annual basis but also vulnerability assessments along the way so that you’re not waiting for an annual point-in-time exercise. Even the disposition of customer data, how do you dispose of it properly? These are some of the things that the GLBA is really expanding on, creating a lot more prescription than they have in the past. 

Rick: The SEC regulates investment advisers and investment companies. The regulations proposed are separate from GLBA as investment advisers and investment companies are regulated in a slightly different way. The GLBA and other regulations, including some that are state-based at the New York Department of Financial Services (NYDFS), are relevant to financial institutions. 

If you’re a financial institution, if you’re an investment adviser, you may have insurance licenses, and you’re subject to what the SEC is doing and the state insurance regulators. Or you may be an investment adviser and you may be licensed by the CFTC. It’s happening in multiple places in multiple ways, and you have to tie it together and get it to all work so that you can comply with all of the regulations and at the same time have a functioning information security program. Make sure that your lawyers and the technical teams are talking so their efforts can complement each other. 

Ron: As an organization, you may be beholden to multiple different types of regulations. Fortunately, most of them are similar, but some standards are a lot more rigorous than others in terms of things like incident reporting and how that’s to be done. One of the best things an organization can do is to not try to conform to compliance, try to be secure. Don’t just try to check a box, make sure that you’re using something that’s going to look at your environment from a 360-degree perspective. If you try to only be compliant with certain standards, then you might leave something out. Most networks are flat, meaning that they’re all interconnected in a way that you can make a lot of jumps from one access path to another, so if you’re concentrating on the front gate and the back gate is open, then that’s problematic for your organization. Using something like a NIST Cybersecurity Framework, using a true security framework in which you can map all of these things to it, don’t try to look at the individual merits of a control specified by one of these standards. Use something like the NIST CSF and then map those standard requirements from these various regulations into them so that you can streamline your process and are more likely to achieve a secure environment, instead of just checking a compliance box.

One of the ways that both Willkie and Pondurance can help customers is to help define whether or not these regulations are applicable to them.

Ron: If you’re not sure, then seek help. In organizations like Willkie and Pondurance and even together, we’ve proven a formula that we can bring. One of the benefits you’re going to get is an independent system that will help bring in the right-size security. No organization is lacking all control, but it’s a matter of shoring things up, making sure that you’re not covered or overcovered in one area but then drastically undercovered in another. Bringing balance to your program is something that we can help with.