The NYS DFS is a regulatory agency that oversees financial institutions operating in New York.  It is responsible for ensuring the safety and soundness of financial institutions, protecting consumers, and promoting the growth of the NY financial services sector.  NYS DFS Covered Entities include banks, insurance companies, mortgage lenders and other financial institutions.

In March 2017, NYS DFS promulgated a Cybersecurity Regulation (23 NYCRR Part 500).  The intent was to ensure covered entities establish and maintain strong cybersecurity practices to protect consumers and the stability of the financial system from the increasing pace of sophistication of cybercriminals targeting the finance industry.  At a high level, the regulation required Covered Entities to perform risk assessments, designate a qualified CISO to implement and enforce a cybersecurity program and policies, and maintain effective cybersecurity functions such as identity & access management, third party service provider oversight and incident response.  The regulation also requires covered entities to notify NYS DFS of cybersecurity incidents within 72 hours of occurrence and to submit an annual certification of their compliance with the regulation.

As of June 2023, at least 12 entities had been impacted by NYS DFS enforcement actions which included monetary penalties for violating the cybersecurity regulation.  All except one of these actions were taken after the entity suffered a security incident.  Details of these actions are published on the NYS DFS website.

In September 2022, NYS DFS published a proposed second amendment to the cybersecurity regulation which will introduce heightened cybersecurity requirements.  As with the initial regulation there was a public comment period which closed on January 9, 2023.  The NYS DFS is now reviewing comments and is expected to finalize the amended regulation soon.

Enforcement actions are the legal measures that NYS DFS takes against Covered Entities that violate its regulations.  Most enforcement actions are based on a consent order which is a legally binding document that outlines the terms and conditions agreed upon by NYS DFS and the Covered Entity to settle the matter without going to trial.  A typical Consent Orders related to NYS DFS 500 describes the cybersecurity incident that led to the action, identifies specific sections of the regulation that were violated, prescribes remedial actions and includes a monetary penalty.  Enforcement actions are public records published on the NYS DFS website and are usually accompanied by a press release.

WithSecure analyzed NYS DFS enforcement actions related to the Cybersecurity Regulation to gain insight into the types of security incidents that occurred and the sections of the regulation that were found to have been violated.  Key findings from this analysis include:

• Of the 47 enforcement actions issued by NYS DFS since 2020, 11 (23%) were related to violations of the Cybersecurity Regulation
• The average Monetary Penalty was almost $3 million
• The reviewed actions identified 55 separate violations of specific sections of the Cybersecurity Regulation
• Seven actions (63%) included a violation for falsely or improperly certifying compliance with the Cybersecurity Regulation as evidenced by the entity suffering a security breach
• Seven actions prescribed specific remediation requirements
• One action was against an entity not subject to regulation by NYS DFS that had experienced a security breach which affected Covered Entities
• The reviewed actions described 15 separate security incidents, with three entities having suffered multiple events
  • The security incidents included 13 instances of phishing attacks
  • Eight of the security incidents resulted in exposure of non-public information
  • Three incidents involved ransomware
  • Three incident results in theft of funding with a combined total of $1,935,000

In September 2022, NYS DFS proposed a Second Amendment to the Cybersecurity Regulation which will add more stringent requirements.  According to NYS DFS, the amendment is intended to address common cyber weaknesses that they have identified since 2017.  In particular, the NYS DFS has observed that some regulated entities have failed to:

• Properly implement MFA for remote access by authorized users
• Remediate vulnerabilities in a timely manner
• Replace vulnerable end of life systems
• Secure ports that allow remote access
• Monitor for abnormal system activity
• Secure applications effectively
• Adapt policies and procedures to evolving cyber threats