Today I attended a presentation by the superintendant and deputy superintendent of New York State Department of Financial Services. A lot of infomration was provided and we intend on making multiple posts based on the infromation we learned.
As a first step, here are the implementation dates provided by DFS. In general this is for “standard” non-exempt organizations. Where possible we will outline requirements for covered entitites with limited exemptions.
December 1, 2023
New reporting requirements, particularly around ransomware payments
Payments must be reported within 24 hours
Covered entities have 30 days to explain the reason for the payment, the decision making process, and impacts on other regulations such as the Office of Foreign Asset Controls
Third-party breaches must be reported
If a covered entity reports an incident to any governmental agency, even outside New York, DFS must also be notified
April 15, 2024
The CISO must sign any complaince attestaions. If the CISO is outsourced, the senior officer responsible for supervising the CISO must attest instead
April 29, 2024
Internal and External Penetration Testing must be completed annually or after major systems changes
Covered Entitites must have a “monitoring process in place to promptly inform of new security vulnerabilities”
Covered Entities must place a priority on remediation of vulnerabilities and do so in a timely manner
Risk Assessment requires expand and must be updated annually
Policies must be expanded and updated annually
Cybersecurity training must be provided to all employees at least annually to also include social engineering training (i.e. phishing training)
November 1, 2024
Limited exemption covered entities must:
Implement Multi-Factor Authentication (MFA) on:
All remote access
All external third-party systems
privileged accounts
Provide security awareness training to all employees at least annually (it should be noted there is no requirement for social engineering training)
Increased encryption requirements
Encryption policies
Must consider all forms of encryption, not just encryption across an external network
CISO can approve reasonable compensating controls
CISO must
Report to the board on any material inadequecies of the cybersecurity program
Report any material cybersecurity issues to the board
The board must:
“excercise oversight of the risk management program”
Must have sufficient understanding of cybersecurity or be advised by professionals that do
Incident Response Plans must be updated, reviewed and tested
Business Continuity and Disaster Recovery (BCDR) plans must be updated and reviewed annually
Employees must be trained on BCDR procedures
The covered entity must maintain backups and test the restoration of critical data and systems
May 1, 2025
Limit access privileges using “Role Based Access Controls” and the “Principle of Least Privileges”
Prompty deactive inactive accounts, including those of employees who seperate from the company
Disable unneccesary services and protocols
Implement a password policy based on “industry best practices”
Conduct automated vulnerability scans “at the frequency determined by the risk assessment”
Protect again malicious code, including anti-malware on all systems, web filtering, and email filtering
November 1, 2025
For “standard” non-exempt organizations implement MFA for all individuals on all systems
It should be noted this requirement does not mention anything about whether or not the system can access Non-Public Information (NPI)
The CISO can approve compensating controls that provide equievelant or superior protection
Implement an Assess Managament/Inventory system