<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

What Happens in New York Doesn't Stay in New York

author Michael Berman
1 min read
Mar 2, 2017

Banks, insurance companies and other entities regulated by the New York Department of Financial Services are facing a new cybersecurity regulation designed to prevent cyberattacks and protect private customer data, but it’s reach may go much farther than New York.

In a rare turn of compliance events, that’s actually a good thing for banks outside New York.

The new regulation, which took effect March 1 and gives institutions a year and a half to comply, spells out specific items that NY financial institutions will need to request from third-party vendors. That includes third-party service provider:

  • Policies and procedures for access controls, including its use of Multi-Factor Authentication;
  • Policies and procedures for use of encryption to protect nonpublic information; and
  • Representations and warranties of cybersecurity policies and procedures related to the security information systems or nonpublic information.

How does this help your institution? If any of your vendors have clients in New York state, it should easily be able to provide your institution with this documentation to help with risk assessments, due diligence and other important areas of vendor management. It’s a great source of boilerplate information on security.

If they can’t give you these documents, that’s cause for concern. It’s a regulatory requirement for NY state clients. A vendor that can’t deliver obviously isn’t that concerned about compliance or regulatory requirements. They may be falling short in other compliance areas too.

Get a handle on your FI's cyber risk with Ncyber, our online FFIEC cybersecurity assessment tool.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply CRA Business Resiliency Lending Compliance Blog Vendor CFPB Ncontinuity Business Continuity Third-Party Vendor Management Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Artificial Intelligence Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Nboardportal Verify integrated risk management
Guarding Against Cyber Events: How Strong Are Your Vendor’s Protections?
Banks

Guarding Against Cyber Events: How Strong Are Your Vendor’s Protections?

Mar 31, 2017 3 min read
Heightened Cybersecurity Risk – Is Your FI Prepared?
Risk Management

Heightened Cybersecurity Risk – Is Your FI Prepared?

Jan 21, 2020 3 min read
The Top 8 Internal Cybersecurity Vulnerabilities Challenging Financial Institutions
Risk Management

The Top 8 Internal Cybersecurity Vulnerabilities Challenging Financial Institutions

Jan 16, 2019 2 min read