NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
A regulation of the New York State financial authority requiring since 2017 a cybersecurity program from the banks and insurers it supervises, strengthened in 2023 notably with reporting of ransoms paid within 24 hours.
Part 500 of the New York State Department of Financial Services regulations, in force since March 1, 2017, was one of the first texts to impose detailed cybersecurity requirements on the financial sector, including insurers licensed in the state, among them many large international groups. It requires a cybersecurity program and policy, a designated chief information security officer, penetration testing, multi-factor authentication, encryption of sensitive data, an incident response plan and an annual certification of compliance signed by management. Its November 2023 amendment strengthened governance obligations, involving the board more closely, created stricter requirements for large companies, and required notifying the authority within 72 hours of a cybersecurity incident and, if a ransom is paid, within 24 hours, then justifying why payment was necessary within 30 days. For insurance, the regulation matters twice: it applies to insurers themselves, and it served as a model for other regulators, including the National Association of Insurance Commissioners for its model data security law.
Textbook case: an insurer licensed in New York pays a ransom after an attack on its claims management subsidiary. Since the November 2023 amendment, it must inform the authority within 24 hours, then send within 30 days an explanation of why payment was necessary, the alternatives considered and the sanctions checks performed.
NYDFS Part 500, 23 NYCRR 500, New York cybersecurity regulation
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.