Key Points:

• The NYDFS Part 500 regulation requires financial institutions to implement more rigorous cybersecurity practices to protect customer data from evolving cyber threats like ransomware and phishing scams.
• Covered entities must conduct annual risk assessments, establish cybersecurity programs with a CISO and incident response plan, and develop processes for detecting and responding to cybersecurity incidents promptly.
• Non-compliance can result in significant financial penalties and reputational damage.
• Metomic helps financial organisations comply with financial industry compliance regulations by safeguarding sensitive data in SaaS and GenAI tools.

The financial industry is a popular target for cybercriminals. From ransomware crippling operations to phishing scams stealing sensitive data, the threats are constant and always becoming more sophisticated.

In response to these growing threats to financial institutions and the customer data they protect, New York's Department of Financial Services (NYDFS) introduced updated regulation - Part 500 - mandating stricter cybersecurity measures for all covered institutions.

What is the NYDFS Part 500 and why was it introduced?

The NYDFS Part 500 requires financial institutions to safeguard customer data more rigorously. It makes several cybersecurity best practices mandatory for organisations covered by the regulation.

The NYDFS Part 500 was first introduced in 2017 but has gone through various amendments. The final revisions to NYDFS cybersecurity rules were completed in December 2023.

The regulation is a response to new, more severe cybersecurity threats to the finance industry. Ransomware attacks on the financial industry have surged recently, fuelled by increased cyberwarfare as geopolitical tensions rise. Modern ransomware strains are also more effective than ever at allowing hackers to steal data and demand large ransoms.

Phishing and social engineering attacks - where employees are tricked into granting access to sensitive data - are also on the rise. In the fourth quarter of 2022, the financial sector was the most targeted for phishing, and experts are warning that AI is only making these attacks more sophisticated.

Who does it apply to?

The NYDFS Part 500 applies to DFS-regulated entities operating under the Banking Law, the Insurance Law, or the Financial Services Law.

Examples include:

• State-chartered banks;
• Private bankers;
• Licensed lenders;
• Foreign banks operating in New York;
• Mortgage and insurance companies;
• Companies providing services to the organisations above.

There are some complete and limited exemptions from the regulation. These can apply to entities below a certain size, inactive ones, and some other categories. As these exemptions are very complex, please consult section 500.19 of the regulation. More information can also be found in the NYDFS resource centre.

What are the new key requirements?

The amended NYDFS Part 500 regulations include strict controls on governance, risk assessments, password and data management, asset inventory, and business continuity plans.

Key requirements to be compliant include:

• Companies need to carry out independent audits based on their risk assessment. These risk assessments need to be done annually, or whenever there’s a material change to the cybersecurity risks the company faces.
• Organisations must produce detailed evidence of a program that addresses the cybersecurity risks identified by the audit. It should include a Chief Information Security Officer (CISO), an incident response plan, and cybersecurity policies. For the latter, there should be continuous monitoring, management of third-party risks, and security training (or the Human Firewall).
• From December 2023, CEOs need to certify compliance based on substantial evidence. Non-compliant firms must outline plans to become compliant.
• Developing processes to quickly detect and respond to cybersecurity incidents. Organisations must ensure that the CISO and senior governing body are informed of material cybersecurity issues and that they report these to the NYDFS within the required timeframes.
• Organisations have to complete thorough asset inventories and implement strong MFA systems.

Organisations should have ensured compliance by April 29, 2024, the deadline for most of the amended Part 500 requirements.

What are the risks of not complying?

Entities covered by New York’s Financial Services Law and Insurance Law face penalties of up to $1,000 per violation. Those under NY’s Banking Law can be fined up to $25,000 per day for intentional violations, $5,000 per day for reckless violations, and $1,000 per day for negligent violations.

The financial penalties for non-compliance can add up to very large sums. For example, EyeMed reached a settlement to pay $4.5 million. The company suffered a large data breach and was deemed to not have properly protected sensitive customer data.

Legal penalties aside, failing to comply with the NYDFS Part 500 also means that you’re more likely to suffer a cyberattack - after all, this is what the regulation is designed to prevent. Suffering a cyberattack can cause serious operational disruption, and addressing this fallout can be costly.

Perhaps more significantly, the reputational damage from cyberattacks can be very high. This may especially be the case for financial institutions, as they require very high levels of trust from the customers whose money they hold. This loss of consumer trust can indirectly lead to substantial financial losses.

How can Metomic help with compliance?

Complying with complex regulations like the NYDFS Part 500 isn’t straightforward, but automation software can help with everything from managing risk assessments to policy generation and continuous monitoring.

Metomic’s data security solution safeguards sensitive customer information stored in your SaaS applications, allowing you to meet the high cybersecurity standards demanded by the NYDFS Part 500.

Metomic enables you to:

• Identify and classify sensitive data across your SaaS, cloud, and GenAI tools to ensure compliance with data protection regulations.
• Limit data exposure with granular access controls allowing only authorised staff to access confidential information.
• Keep track of data sharing and user interactions within your organisation in real-time.
• Enforce data protection policies to meet your specific needs and industry standards, helping to ensure full compliance and enhanced security.

Discover how Metomic can help your financial institution secure its sensitive data and comply with the NYDFS Part 500 - request a personalised demo with one of our data security specialists.