The New York Department of Financial Services (NYDFS) raised the bar for cybersecurity with its landmark regulation, 23 NYCRR 500. It sits in Title 23 of the New York Codes, Rules and Regulations, Part 500, and applies to “covered entities” regulated by NYDFS such as banks, insurers, mortgage companies, and other licensed financial institutions as well as certain third‑party providers that support them.
What is the goal of 23 NYCRR 500? Effective, mandatory end-to-end security throughout the data life cycle is at the core of this regulation.
A pivotal requirement is found in Section 500.03, which calls for the covered entity (typically the CISO) to create and maintain a comprehensive cybersecurity program with associated procedures “designed to protect the confidentiality, integrity and availability of the covered entity’s information systems and nonpublic information stored on those information systems.”
Key Compliance Activities for Complying with 23 NYCRR 500
Appointment a CISO (if one isn’t already in place)
Document all organizational cybersecurity policies and procedures
Perform risk assessments (which must be kept up to date on an ongoing basis)
Penetration testing and vulnerability assessments
Train all staff on a regular basis
Monitor your assets and create audit trails
Limit user privilege
Evaluate third-party service providers and their security policies
Securely destroy unnecessary data
Fortra Solutions for Navigating 23 NYCRR 500
Fortra Data Loss Prevention and Fortra Data Classification can support your organization meet the requirements of 23 NYCRR 500.