<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

What Happens in New York Doesn't Stay in New York

author Michael Berman
1 min read
Mar 2, 2017

Banks, insurance companies and other entities regulated by the New York Department of Financial Services are facing a new cybersecurity regulation designed to prevent cyberattacks and protect private customer data, but it’s reach may go much farther than New York.

In a rare turn of compliance events, that’s actually a good thing for banks outside New York.

The new regulation, which took effect March 1 and gives institutions a year and a half to comply, spells out specific items that NY financial institutions will need to request from third-party vendors. That includes third-party service provider:

  • Policies and procedures for access controls, including its use of Multi-Factor Authentication;
  • Policies and procedures for use of encryption to protect nonpublic information; and
  • Representations and warranties of cybersecurity policies and procedures related to the security information systems or nonpublic information.

How does this help your institution? If any of your vendors have clients in New York state, it should easily be able to provide your institution with this documentation to help with risk assessments, due diligence and other important areas of vendor management. It’s a great source of boilerplate information on security.

If they can’t give you these documents, that’s cause for concern. It’s a regulatory requirement for NY state clients. A vendor that can’t deliver obviously isn’t that concerned about compliance or regulatory requirements. They may be falling short in other compliance areas too.

Get a handle on your FI's cyber risk with Ncyber, our online FFIEC cybersecurity assessment tool.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Nrisk Regulatory Compliance Management News & Updates HMDA Risk Mortgage Lenders Ncomply Vendor Management Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Ntransmittal Audits & Findings Company Culture OCC Regulatory Updates Audit Nverify Regulatory Compliance Exams FDIC Compliance Management Findings Nfindings NCUA Contract Management Employee Intranet Contract FRB Business Continuity Management FFIEC Findings Management Ncontracts manager Third-Party Vendors Vendor Risk Enterprise Risk Management ABA Bank Access Control Audit Findings Board Portal Call Report Due Diligence Efficiency Employee Engagement Exam findings FIEC Inc. 5000 Internal Audit Management Nboardportal Verify Wealth Management
Heightened Cybersecurity Risk – Is Your FI Prepared?
Risk Management

Heightened Cybersecurity Risk – Is Your FI Prepared?

Jan 21, 2020 3 min read
Guarding Against Cyber Events: How Strong Are Your Vendor’s Protections?
Banks

Guarding Against Cyber Events: How Strong Are Your Vendor’s Protections?

Mar 31, 2017 3 min read
The Top 8 Internal Cybersecurity Vulnerabilities Challenging Financial Institutions
Risk Management

The Top 8 Internal Cybersecurity Vulnerabilities Challenging Financial Institutions

Jan 16, 2019 2 min read