The regulation demands that organizations implement and maintain a comprehensive cybersecurity program. At the center is a written policy covering data governance, asset management, network security, and access controls. You must document, test, and update these policies on a regular schedule.
Risk Assessments
You are required to perform periodic risk assessments. These evaluations must identify threats, vulnerabilities, and the likelihood of exploitation. Results from these assessments must drive your security controls, monitoring, and incident response measures.
Access and Authentication
Multi-factor authentication (MFA) is mandatory for any system storing or accessing nonpublic information. Least privilege must be enforced. Access rights need review on a set schedule, with immediate revocation for departures or role changes.
Cybersecurity Personnel and Oversight
Covered entities must appoint a qualified Chief Information Security Officer (CISO). This role oversees implementation, reports on effectiveness of the program, and ensures compliance with NYDFS cybersecurity regulation requirements. Reports must be delivered annually to the board or equivalent governing body.