Earlier this month, the New York Department of Financial Services (“NYDFS”) announced that it had finalized the Second Amendment to its “first-in-the-nation” cybersecurity regulation, 23 NYCRR Part 500.  This Amendment implements many of the changes that NYDFS originally proposed in prior versions of the Second Amendment released for public comment in November 2022 and June 2023, respectively.  The first version of the Proposed Second Amendment proposed increased cybersecurity governance and board oversight requirements, the expansion of the types of policies and controls companies would be required to implement, the creation of a new class of companies subject to additional requirements, expanded incident reporting requirements, and the introduction of enumerated factors to be considered in enforcement decisions, among others.  The revisions in the second version reflect adjustments rather than substantial changes from the first version.  Compliance periods for the newly finalized requirements in the Second Amendment will be phased over the next two years, as set forth in additional detail below.

The finalized Second Amendment largely adheres to the revisions from the second version of the Proposed Second Amendment but includes a few substantive changes, including those described below:

• The finalized Amendment removes the previously-proposed requirement that each class A company conduct independent audits of its cybersecurity program “at least annually.”  While the finalized Amendment does require each class A company to conduct such audits, they should occur at a frequency based on its risk assessments.  NYDFS stated that it made this change in response to comments that an annual audit requirement would be overly burdensome and with the understanding that class A companies typically conduct more than one audit annually.  See Section 500.2 (c).
• The finalized Amendment updates the oversight requirements for the senior governing body of a covered entity with respect to the covered entity’s cybersecurity risk management.  Updates include, among others, a requirement to confirm that the covered entity’s management has allocated sufficient resources to implement and maintain a cybersecurity program.  This requirement was part of the proposed definition of “Chief Information Security Officer.”  NYDFS stated that it moved this requirement to the senior governing bodies in response to comments that CISOs do not typically make enterprise-wide resource allocation decisions, which are instead the responsibility of senior management.  See Section 500.4 (d).
• The finalized Amendment removes a proposed additional requirement to report certain privileged account compromises to NYDFS.  NYDFS stated that it did so in response to public comments that this proposed requirement “is overbroad and would lead to overreporting.”  However, the finalized Amendment retains previously-proposed changes that will require covered entities to report certain ransomware deployments or extortion payments to NYDFS.  See Section 500.17 (a).

NYDFS also provided further context on its expectations for compliance in responding to public comments even where it did not make changes.  For example, in response to a comment suggesting that NYDFS add a new section to the regulation to address risks associated with AI, NYDFS declined to make changes but noted that it “expects covered entities to take these risks into account in their risk assessments and address them in their cybersecurity programs.” 

Compliance requirements for the amended regulation will take effect in stages.  Below is a list of key compliance dates.

• Covered entities will have 180 days from the effective date of the Second Amendment, or until April 29, 2024, to comply with the amended regulation, unless specified otherwise. 
• The expanded incident reporting requirements will take effect on December 1, 2023.  New reporting requirements include, among others, an obligation to notify NYDFS within 72 hours when a cybersecurity event results in the deployment of ransomware within a material part of the covered entity’s information systems, and within 24 hours if a covered entity makes an “extortion payment” in connection with a cybersecurity event involving the covered entity.  The covered entity must also provide specific additional information regarding the payment within 30 days.  See Section 500.17.
• Governance, encryption, incident response planning and business continuity management, and exemption provisions will go into effect on November 1, 2024.  See Sections 500.4, 500.15, 500.16, and 500.19 (a).
• Vulnerability scanning, access privileges and management, and monitoring and training provisions will go into effect on May 1, 2025.  See Sections 500.5 (a)(2), 500.7, 500.14 (a)(2), and 500.14 (b).
• Multi-factor authentication, and asset management and data retention provisions will take effect on November 1, 2025.  See Sections 500.12 and 500.13 (a).

To provide more information about changes in the Second Amendment, NYDFS will host briefings and seminars over the coming months.  Please refer to the NYDFS website for the registration details.