Minimum standards proposed in September have been updated to provide more wiggle room for banks, financial institutions and insurance companies operating in New York.
Reposted with permission from Cybersecurity Law & Strategy.
On December 28, the New York State Department of Financial Services (DFS) issued an updated version of its first-in-the-nation cybersecurity regulation after having “carefully considered all comments submitted” during the comment period following the issuance of the original regulation in September. The comments received by the DFS included a strongly worded and detailed letter authored by banking and insurance industry groups. The updated draft is subject to an additional comment period of 30 days and the final version will become effective March 1, 2017.
The updated proposed regulation provides significantly more wiggle room than the original version, shifting from an approach that enforces minimum standards to a risk-based approach with increased transition periods for compliance. A few highlights of the changes are summarized below:
Timeline
In addition to the delayed effective date of March 1 (from January 1)and the default transition period of 180 days to comply (which now runs on August 28, 2017), the DFS has built in longer transition periods for certain sections. New deadlines include:
- February 15, 2018 – deadline for submission of Certificate of Compliance
- March 1, 2018 – deadline for compliance with Risk Assessment, Multi-Factor Authentication and Penetration Testing and Vulnerability Assessment sections as well as portions of the Chief Information Security Officer and Training and Monitoring sections
- August 30, 2018 – deadline for compliance with Audit Trail, Application Security, Limitations on Data Retention and Encryption of Nonpublic Information sections as well as a portion of the Training and Monitoring section
- March 1, 2019 – deadline for compliance with Third-Party Service Provider Security Policy
Other Changes of Significance
Penetration Testing and Vulnerability Assessments (Section 500.05): In addition to the longer transition period provided, this section was updated to allow for “continuous monitoring or periodic penetration testing and vulnerability assessments.” If the proposed regulation becomes final in its current form, vulnerability assessments will only be required bi-annually. In the DFS’s original proposed regulations, penetration testing would have been required annually and vulnerability assessments quarterly “at a minimum,” and there was no suggestion of continuous monitoring as a substitute option.
Third Party Service Provider Security Policy (Section 500.11): In addition to the 18 month extension on implementation of this section, this section sets a lower threshold of accountability for vendors with access to information systems and nonpublic information and then, only “to the extent possible.” Notable changes include removal of the requirement that contracts with third party service providers require “prompt notice” of cybersecurity events and the right “to perform cyber security audits” of the third party.
Limitations on Data Retention (Section 500.13): Secure disposal is still required in the updated proposal, but the word “timely” has been removed and replaced with “on a periodic basis.” An exception has also been added for destruction of data “where targeted disposal is not reasonably feasible due to the manner in which the information is maintained.”
Training and Monitoring (Section 500.14): Covered entities are still required in the updated proposal to provide regular cybersecurity awareness training, but all personnel are no longer required to attend.
Encryption of Nonpublic Information (Section 500.15): The original proposed regulation provided a one year lead time for implementation of encryption in transit and a five year lead time for implementation of encryption at rest. The updated proposed regulation indicates that compensating controls may be used indefinitely if encryption of nonpublic information is infeasible.
Notices to the Superintendent (500.17): The requirement to notify the superintendent “as promptly as possible but in no event later than 72 hours from a determination that a Cybersecurity Event” has occurred remains, but the words “actual or potential” have been removed from the definition.
Exceptions (Section 500.19): The exception for covered entities with “fewer than 1000 customers” has been removed and replaced with an exception for covered entities with “fewer than 10 employees including any independent contractors.”
General Changes: Throughout the updated proposed regulation, phrases such as “at a minimum”, “no less than annually” and “assigning accountability” have been removed and phrases such as “to the extent applicable” and “updated as necessary” have been added.
The full text of the updated DFS regulation is available here.
As updated and proposed, the DFS cybersecurity regulation significantly softens the “mandatory minimum” approach taken in the earlier version. The changes will reduce the expense of supporting conflicting or duplicative regulatory requirements and security framework best practices, and will likely be welcomed by covered entities and the third party vendors that support them. Alignment of existing policies and procedures with the new regulation and the likely forthcoming federal regulations will be far from automatic, however, and the evolving threat landscape should encourage businesses in all industries to improve their security posture on an ongoing basis.
*****
Justin Hectus is the Chief Information Officer and Chief Information Security Officer of Keesal, Young & Logan (KYL). A member of Cybersecurity Law & Strategy’s Board of Editors and a two-time ILTA Distinguished Peer Award winner, his dual role at KYL incorporates development and execution of the firm’s strategic technology vision and leadership of initiatives focused on managing risks for the firm and its clients.
Julie Taylor is a shareholder with Keesal, Young & Logan in its San Francisco office and is admitted to practice in California and Washington. Julie litigates employment matters throughout the United States, and regularly advises clients on a myriad of employee-related concerns. In addition, Julie is significantly involved in the firm’s nationally recognized e-discovery, technology and cybersecurity initiatives.
The views expressed in the article are those of the authors and not necessarily the views of their clients or other attorneys in their firm.