The New York State Department of Financial Services (NYDFS) recently expanded its cybersecurity regulations. The amendment, which is significant in nature, establishes affirmative oversight duties related to cybersecurity and demands that companies report any extortion payments made in cybersecurity contexts directly to the agency.
As outlined by global law firm Jones Day, these changes hold several implications for corporate governance. The NYDFS’s clout in monetary and financial matters means that this change has the potential to significantly influence management strategies within corporations, especially given that the regulations now require active steps from companies in terms of cybersecurity protection and response.
- Extortion Payment Reporting
- Corporate Governance
- Technical requirements
Under the new rules, organizations must report to the NYDFS within 36 hours of making any payment associated with a cybersecurity incident. This includes payments made in the case of ransomware attacks, which have been a growing threat for corporations worldwide.
The regulations articulate a strong stance on the board’s responsibility in cybersecurity matters. The board or an equivalent governing authority is now mandated to approve the organization’s cybersecurity plan. By binding cybersecurity to the high echelons of corporate governance, NYDFS is signalling the serious nature of these security concerns.
The guidelines call for companies to implement specific technical measures designed to secure their data and prevent breaches. These include encryption, multi-factor authentication, and periodic penetration testing, among other advanced measures.
While these changes add to the regulatory load for corporations operating under the purview of the NYDFS, they also underscore the increasing importance that regulatory bodies worldwide are placing on cybersecurity. The NYDFS move offers a potentially indicative model for other states and countries to follow.