If you are a “Covered Entity” regulated by the New York State Department of Financial Services you must be compliant with the newly issued cybersecurity legislation that went into effect on March 1, 2017 (23 NYCRR Part 500), and you are also responsible for compliance by your third-party providers.
Third Party Cybersecurity Compliance Requirements in New York
Relative to how you employ and manage third party providers, here are a few highlights of the legislation that could have an impact on your policies, processes and cyber security practices:
- For the third party providers you work with, you will need to define the minimum cybersecurity practices required for them to do business with you.
- For the third party providers you work with, you will need to inform them of the sections of the regulation (e.g. encryption, multi-factor authentication) they must implement.
- You must do an assessment of each third-party provider’s cybersecurity program, policies and practices based on their access to your information systems and/or nonpublic information.
- You will be responsible for defining and communicating your acceptable minimum cybersecurity practices with each third-party provider you do business with.
- The cybersecurity policies and practices you have in place will likely need to be mirrored by each third-party provider you do business with.
- From time to time, you will need to conduct a due diligence assessment of your third-party providers’ cyber security policies and practices to see if they are compliance with your policies and practices, and the new regulation.
- Your third-party providers will be required to implement Multi-Factor Authentication or Risk-Based Authentication to protect against unauthorized access to your Nonpublic Information or Information Systems.
- With certain exceptions, your third-party providers will be required to implement encryption to protect Nonpublic Information in transit and at rest.
- Your third-party providers will be required to provide notice of any cybersecurity event directly impacting your Information Systems or your Nonpublic Information.
Do Covered Entities Need to Require a Comprehensive a Cybersecurity Audit from Their Third-Party Providers?
Having all your third-party providers conduct an audit of their cyber security program may be VERY difficult and problematic for both you and them.
One alternative for compliance purposes for compliance purposes (and our recommendation) is that that you have a specific examination performed by an independent CPA firm to attest the cybersecurity practices they have in place.
Comply with New York's 2017 Cybersecurity Regulations: Start Here.
The process of getting into compliance with the New York State Cybersecurity Regulations and their “pass through” to your third-party providers should start with a comprehensive assessment of your current cybersecurity program and controls against the new regulations and other leading frameworks to validate its design and operation.
The experts in Freed Maxick’ s Risk and Technology Advisory and Assurance Practice can help you to this end, as well as assisting in development and implementation of a remediation plan.
Our thorough assessment includes investigations of your policies, processes and practices governing your relationship with all relevant third party providers, as well as an assessment of their programs to provide assurances of their compliance with your requirements.
You can download our full New York Cybersecurity Regulation whitepaper here. To schedule an initial consultation, click here or call Dave Hansen, Principal at 585.360.1481.