- Use defensive infrastructure and the implementation of policies and procedures to protect its information systems and the nonpublic information stored on those systems from unauthorized access, use, or other malicious acts;

- Detect “cybersecurity events”;

- Respond to identified or detected cybersecurity events to mitigate any negative effects;

- Recover from cybersecurity events and restore normal operations and services; and

- Fulfill applicable regulatory reporting obligations.

Insurers and other financial institutions also must adopt a written cybersecurity policy addressing:

- Information security;

- Data governance and classification;

- Asset inventory and device management;

- Access controls and identity management;

- Business continuity and disaster recovery planning and resources;

- Systems operations and availability concerns;

- Systems and network security;

- Systems and network monitoring;

- Systems and application development and quality assurance;

- Physical security and environmental controls;

- Customer data privacy;

- Vendor and “third party service provider” management;

- Risk assessment; and

- Incident response.  

In addition, insurers and other financial institutions must designate a chief information security officer” (“CISO”). The CISO must report in writing at least annually to the entity's board of directors on its cybersecurity program and material cybersecurity risks.

Among other things, the revised proposed regulation also requires monitoring and testing designed to assess the effectiveness of an entity's cybersecurity program; requires written policies and procedures for third party service providers; advocates multi-factor authentication or risk-based authentication to protect against unauthorized access to nonpublic information or information systems; and mandates training and monitoring as part of a cybersecurity program.

In a statement, the superintendent of the DFS, Maria T. Vullo, said, “New Yorkers must be confident that the banks, insurance companies, and the other financial institutions that they rely on are securely handling and establishing necessary protocols that ensure the security and privacy of their sensitive personal information. This updated proposal allows an appropriate period of time for regulated entities to review the rule before it becomes final and make certain that their systems can effectively and efficiently meet the risks associated with cyber threats.”

The American Insurance Association (“AIA”) said in a statement that it was “encouraged” by the revision to the proposed regulation, explaining that although the regulation “continues to be quite broad in scope, there have been some improvements in the revised regulation to provide financial institutions with greater flexibility in creating cybersecurity programs that best fits their risk profile.”

In particular, the AIA said, it was “pleased to see that DFS has addressed our concerns regarding some of the more restrictive and burdensome requirements of the regulation, including those relating to encryption and audit trails. Additionally, the extended transition period is a positive development as it will allow more time for companies to comply with certain requirements in the regulation.”

Alison Cooper, Northeast region vice president for AIA, said in a statement, “AIA thanks the Department of Financial Services for working with the industry in addressing many of our concerns with the initial proposed cybersecurity regulation. As we continue to review the revised regulation, we're encouraged by a number of changes and believe this is a good step in the right direction. The extended deadline and comment period will give insurers additional opportunities to provide feedback to the department, allowing for greater coordination in achieving our ultimate shared goal: protecting customers' information and corporate networks from cyberattacks. As such, the revisions and delayed implementation will allow insurers to better tailor and implement cybersecurity programs in a risk-based manner.”

Learn more:

Proposed Regulation

New York Proposes Cybersecurity Regulation for Insurers