Global Privacy and Cybersecurity Law Updates and Analysis
On November 1, 2023, New York Governor Hochul announced that the New York State Department of Financial Services (“NYDFS”) amended its Cybersecurity Regulation applicable to covered financial institutions. Our previous blog post covered key proposed changes to the Cyber Regulation.
The NYDFS, which regulates financial institutions including insurance companies, mortgage brokers and banks, adopted the original Cybersecurity Regulation in 2017. The new amendments strengthen the initial framework and require NYDFS-regulated entities to adhere to a number of additional prescriptive data security requirements, including adopting controls to prevent unauthorized access to information systems, conducting more regular risk assessments, maintaining robust incident response planning procedures, and adhering to updated notification requirements, such as the new requirement to report ransomware extortion payments to NYDFS within 24 hours of the payment.
The amended Cybersecurity Regulation will take effect in phases. Regulated entities generally have until April 29, 2024 to comply with the amended Regulation. Notably, however, the new reporting requirements will take effect sooner, on December 1, 2023. For certain other requirements, regulated entities will have between one and two years to reach compliance. Specific compliance dates can be found on the NYDFS Cybersecurity Resource Center website.
In the coming weeks, NYDFS will host an upcoming series of training sessions on the amended Cybersecurity Regulation to help regulated entities plan for compliance.
Hunton Andrews Kurth’s Privacy and Cybersecurity practice helps companies manage data at every step of the information life cycle. The firm is a leader in its field and for the fourth consecutive year has been ranked by Computerworld magazine in a survey of more than 4,000 corporate privacy leaders as the top law firm globally for privacy and data security. Chambers and Partners also rated Hunton Andrews Kurth the top privacy and data security practice in its Chambers Global, Chambers USA and Chambers UK guides.
Hunton Andrews Kurth’s award-winning Privacy & Information Security Law Blog is among the top-ranked legal blogs.

source