{"id":1201,"date":"2017-06-27T09:59:49","date_gmt":"2017-06-27T06:59:49","guid":{"rendered":"https:\/\/www.endpointprotector.com\/blog\/?p=1201"},"modified":"2026-04-07T14:12:28","modified_gmt":"2026-04-07T11:12:28","slug":"an-overview-of-the-nydfs-cybersecurity-regulation","status":"publish","type":"post","link":"https:\/\/www.endpointprotector.com\/blog\/an-overview-of-the-nydfs-cybersecurity-regulation\/","title":{"rendered":"An Overview of The\u00a0NYDFS Cybersecurity Regulation"},"content":{"rendered":"

The NYDFS cybersecurity regulation requires financial institutions to implement risk-based security programs to protect sensitive data and systems. Key requirements include encryption, access controls, incident response, employee training, and breach reporting within 72 hours. Organizations must also ensure third-party compliance and submit annual certifications.<\/em><\/p>\n

What is NYFDS?<\/h2>\n

Last year, New York became the 1st state that proposed cyber security regulations for the financial organisations. This year, on March 1st, the New York Department of Financial Services (NYDFS) Cybersecurity Requirements came into effect.<\/p>\n

This new regulation requires financial institutions like banks and insurance companies, and others\u00a0to establish and maintain cybersecurity programs in order to protect consumers\u2019 private data.\u00a0 Financial organisations have an 180-days transition period to enhance their\u00a0infosec implementation\u00a0in\u00a0order to\u00a0protect\u00a0their Information Systems and Nonpublic Information (NPI). By August 28, 2017, must have a cybersecurity program in place and starting February 15, 2018,\u00a0they\u00a0must be able to demonstrate they are compliant by submitting annual\u00a0Certifications\u00a0of\u00a0Compliance.<\/p>\n

What is\u00a0the\u00a0Information System?<\/h2>\n

The\u00a0Information System<\/a> represents\u00a0\u00a0\u201ca discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of electronic information, as well as any specialized system such as industrial\/process controls systems, telephone switching, and private branch exchange systems, and environmental control systems.\u201d
\nBasically, the NYDFS uses the Information System\u00a0to express the sensitive data as well as the systems that must be safeguarded against cybercriminals and other cyber security threats.<\/p>\n

What is Nonpublic Information (NPI)?<\/h2>\n

Nonpublic Information<\/a>\u00a0means \u201call electronic information that is not Publicly Available Information\u00a0and\u00a0contains:<\/p>\n

    \n
  1. Business related information<\/li>\n
  2. Information concerning an individual\u00a0that can be used to identify him\/her –\u00a0name, number, personal mark, or other identifier, in combination with social security number, drivers\u2019 license number or non-driver identification card number, account number, credit or debit card number, any security code, access code or password that would permit access to an individual\u2019s financial account,\u00a0or biometric records.<\/li>\n
  3. Any information or data, except age or gender,\u00a0related to the physical, mental or behavioral health of any individual or his\/her family collected and processed by a health care provider or derived from a health care institution.<\/li>\n<\/ol>\n

    Whom it covers?<\/h2>\n

    The NYDFS rule focuses on protecting the data of customers of financial institutions with branches in NY, third-party suppliers, like banks, insurance companies, brokers, mortgage lenders, investment companies, and others.
    \nAccording to the\u00a0    NYDFS website<\/a>, the new rule supervises \u201cnearly 1,900 banking and other financial institutions with assets of more than $2.9 trillion\u201d and \u201call insurance companies that do business in New York,\u201d which includes \u201cnearly 1,700 insurance companies with assets exceeding $4.2 trillion.\u201d
    \nThe proposed regulations will reduce the risk of data breaches caused by insider threats, ignorance or unintentional data leakage.<\/p>\n

    What are the key\u00a0points?<\/h2>\n

    NYDFS regulations require Covered Entities to:<\/p>\n