On September 13, 2016, the New York Department of Financial Services introduced a new rule that would require banks, insurance companies and other financial institutions regulated by the Department to establish and maintain a cybersecurity program designed to protect consumers and ensure the safety of New York’s financial services industry. The proposed regulation is subject to a 45-day notice and public comment period, following the September 28, 2016 publication in the New York State register before final issuance.
Under the proposed rule, regulated financial institutions would be required to:
- Establish a cybersecurity program;
- Adopt a written cybersecurity policy;
- Designate a Chief Information Security Officer responsible for implementing and overseeing the new cybersecurity program and policy; and
- Have policies and procedures designed to ensure the security of information systems and nonpublic information accessible to third-parties.
Establishment of a Cybersecurity Program
According to the proposed rule, regulated financial institutions will need to establish a “cybersecurity program designed to ensure the confidentiality, integrity and availability of information systems that performs five core cybersecurity functions:”
- Identification of cyber risks.
- Implementation of policies and procedures to protect unauthorized access / use or other malicious acts.
- Detection of cybersecurity events.
- Responsiveness to identified cybersecurity events to mitigate any negative events.
- Recovery from cybersecurity events and restoration of normal operations and services.
Additional requirements for each “cybersecurity program” include:
- Annual penetration testing and vulnerability assessments.
- Implementation and maintenance of an audit trail system to reconstruct transactions and log access privileges.
- Limitations and periodic reviews of access privileges.
- Written application security procedures, guidelines and standards that are reviewed and updated by the CISO at least annually.
- Annual risk assessment of the confidentiality, integrity, and availability of information systems; adequacy of controls; and how identified risks will be mitigated or accepted.
- Employment and training of cybersecurity personnel to stay abreast of changing threats and countermeasures.
- Multi-factor authentication for individuals accessing internal systems who have privileged access or to support functions including remote access.
- Timely destruction of nonpublic information that is no longer necessary except where required to be retained by law or regulation.
- Monitoring of authorized users and cybersecurity awareness training for all personnel.
- Encryption of all nonpublic information held or transmitted.
- Written incident response plan to respond to, and recover from, any cybersecurity event.
Adoption of a Cybersecurity Policy
The new rule would require regulated financial institutions to adopt a written cybersecurity policy, setting forth “policies and procedures for the protection of their information systems and nonpublic information that addresses, at a minimum, the following:”
- Information security.
- Data governance and classification.
- Access controls and identity management.
- Business continuity and disaster recovery planning and resources.
- Capacity and performance planning.
- Systems operations and availability concerns.
- Systems and network security.
- Systems and network monitoring.
- Systems and application development and quality assurance.
- Physical security and environmental controls.
- Customer data privacy.
- Vendor and third-party service provider management.
- Risk assessment.
- Incident response.
Creation of Chief Information Security Officer
The new rule would require regulated financial institutions to designate a qualified individual to serve as a CISO, responsible for “overseeing and implementing the institution’s cybersecurity program and enforcing its cybersecurity policy.” The new rule also would require the CISO to “report to the board, at least bi-annually to:”
- Assess the confidentiality, integrity and availability of information systems.
- Detail exceptions to cybersecurity policies and procedures.
- Identify cyber risks.
- Assess the effectiveness of the cybersecurity program.
- Propose steps to remediate any inadequacies identified.
- Include a summary of all material cybersecurity events that affected the regulated institution during the time period addressed by the report.
Third Party Protections
The new rule also would require regulated financial institutions to have policies and procedures designed to ensure the security of information systems and nonpublic information accessible to, or held by, third-parties, including the following:
- Identification and risk assessment of third-parties with access to such information systems or such nonpublic information.
- Minimum cybersecurity practices required to be met by such third-parties.
- Due diligence processes used to evaluate the adequacy of cybersecurity practices of such third-parties.
- Periodic assessment, at least annually, of third-parties and the continued adequacy of their cybersecurity practices.
A draft of the proposed rule is here.
