DFS NYS New Cyber Security Regulation for Financial Institutions

23 NYCRR 500

The March 2019 DFS deadline is fast approaching. Are you ready?

Download The 23 NYCRR 500 Checklist

On March 1, 2017, the NY State Department of Financial Services’ (DFS) issued new mandatory cyber security requirements for financial services, with required implementation to take place by August 28, 2017. This “risk-based, holistic, and robust security program” is designed to protect consumers’ private data within financial organizations. MDS has provided a comprehensive breakdown of the security requirements and the necessary solutions we provide to help get your cyber security framework compliant and secure.

Who is Affected?

The NYDFS Cyber Security Requirements cover any organization required to “operate under DFS license, registration or charter, or which are otherwise DFS-regulated, as well as, by extension, unregulated third-party service providers to regulated entitles.”

Including:

state-chartered banks
licensed lenders
private bankers
service contract providers
trust companies
mortgage companies
insurance companies doing business in New York
foreign banks licensed to operate in New York

Become DFS Compliant in 5 Steps

Learn How

Become Compliant with Microsoft 365

Learn How

What You Need to Do - and How MDS Can Help:

According to the new cyber security NYDFS regulations, it is mandatory for all covered entities to implement and file the following regulations by August 28th, 2017. Those who are not compliant by this deadline will be penalized.

While all this represents new challenges for organizations in the financial services field and beyond, the common denominator is that a sound strategy and the right tools and solutions will streamline, simplify and provide a stronger cyber security program for your organization. The Compliance Experts at MDS will not only ensure you are compliant, but that you have implemented a more effective, long-term cyber security protocol in the process.

DFS Made Simple - Download our eBook Now

Download The eBook

Cyber Security Program (Section 500.02)

Establish a cyber security program based on periodic risk assessments meant to identify and evaluate risks. Effectively protect information systems and nonpublic information; detect, respond to, and recover from cyber events and adhere to all reporting obligations.

Cyber Security Policies (Section 500.03)

Create and maintain written policies and procedures to protect your organization’s systems and nonpublic information based on the company’s risk assessment.

Chief Information Security Officer (Section 500.04)

Appoint a CISCO to oversee and implement the required cyber security program. The CISCO may be employed by an affiliate, the regulated entity, or a third party service provider.

With MDS’s Virtual CISCO service, our certified engineers provide your organization with qualified MDS security advisers to assist in guiding security efforts, execute plans and implement a custom strategy for your company. MDS acts as an extension of your team, providing security program assessment, development and management.

Penetration Testing and Vulnerability Management (Section 500.05)

MDS Continuous Penetration Testing gives your organization a realistic look at how attackers exploit IT vulnerabilities and actionable ways on how to stop them. Our team not only conducts hundreds of penetration tests annually, but our engineers continuously train on the latest security innovations to ensure we understand this constantly evolving epidemic, learning the latest techniques to identify and negate threats.

Audit Trail (Section 500.06)

Securely maintain systems must be designed to: reconstruct fiscal transactions following a security breach and audit trails to detect and respond to cyber security events (maintain records for 3 years).

Application Security (Section 500.08)

Security best practices and procedures for internally developed apps is mandatory, along with the periodic evaluating, assessing and security testing of externally developed apps. With MDS financial application security solutions, we can interpret and test today’s modern and complex apps, providing your organization with comprehensive and actionable vulnerability reports.

Risk Assessments (Section 500.09)

Conduct bi-annual, documented risk assessments that consider threats and the examination of current controls in relation to identifying risk.

MDS offers assessments that evaluate the effectiveness of your cyber security controls and provides a prioritized and risk-based security road-map, with detailed recommendations to you can update your security protocol with confidence.

Cybersecurity Personnel and Intelligence (Section 500.10)

Qualified cyber security personnel or an “Affiliate or a Third-Party Service Provider” sufficient to manage the organization’s risks and to perform or oversee the performance of essential cyber security functions. MDS engineers are highly trained in cyber security to effectively address relevant risks, and continuously attend trainings in order to effectively monitor the evolving threats and corresponding countermeasures.

Multi-Factor Authentication (Section 500.12)

To protect unauthorized access to Nonpublic Information, the use of Multi-Factor Authentication (more than one method of credentials to verify user identity) is required for any individual accessing the Covered Entity’s internal networks from an external network.

Limitations on Data Retention (Section 500.13)

Each Covered Entity is required to have policies and procedures for the secure periodic disposal of specific categories of Nonpublic Information.

Training and Monitoring (Section 500.14)

Covered entities are required to implement risk-based policies to monitor the activity of Authorized Users and detect unauthorized access or use of Nonpublic Information. Regular cyber security training for all personnel is also required.

Encryption of Nonpublic Information (500.15)

All covered entities must implement encryption controls based on the mandatory risk assessment (Section 500.09), to protect Nonpublic Information held or transmitted over external networks. Such controls must be reviewed and approved by the mandated CISO on an annual basis.

Incident Response Plan (Section 400.16)

An established written incident response plan for a responding to and recovering from cyber security events must be implemented. With MDS monitoring your environment, we utilize our preventative and reactive protocol to ensure an immediate response at the first sign of a breach.

Reach out to an MDS expert now and we will get back to you shortly!

Your content goes here. Edit or remove this text inline or in the module Content settings. You can also style every aspect of this content in the module Design settings and even apply custom CSS to this text in the module Advanced settings.