Add Watermark To Legal New York Banking Forms For Free

Section 500.03 Cybersecurity Policy. Each Covered Entity shall implement and maintain a written cybersecurity policy setting forth the Covered Entity's policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems.

The NYDFS Cybersecurity Regulation (23 NYCRR 500) is a new set of regulations from the NY Department of Financial Services (NYDFS) that places cybersecurity requirements on all covered financial institutions.

The 23 NYCRR 500 requires covered entities to protect sensitive nonpublic information at rest and in transit. When doing so, any controls deemed infeasible for data transmission at rest or in transit must be replaced using effective alternative compensating controls approved by the CISO.

NYDFS first proposed updates to Part 500 in July 2022, which included requiring: 1) greater independence for covered entities' chief information security officers, 2) annual risk assessments for covered entities, and 3) increased breach notification requirements.

Rule 504 requires each regulated institution in New York to maintain a logically constructed transaction monitoring (TM) program. The money laundering reporting officer/Bank Secrecy Act officer is required to assess the system's human or automated flaws annually as part of a certification process.

Under 23 NYCRR Part 500, the Covered Entity is responsible for compliance with respect to its Information Systems. Therefore, it must evaluate and address any risks that a BHC (or other affiliate of the Covered Entity) presents to the Covered Entity's Information Systems and/or Nonpublic Information.