The recent amendments made by the New York Department of Financial Services (DFS) to its cybersecurity regulations have wide-ranging implications for legal professionals working within large-scale corporations and law firms.
The revisions entail the introduction of new requirements for covered entities and the establishment of a new class of covered entity that is subject to specific stipulations. Furthermore, the amendments alter the set of covered entities that may be exempt from certain requirements.
The changes were effective from November 1, 2023, but several other modifications will come into force over the subsequent period, specifically, after one month, one year, 18 months, and two years. These changes are expected to have considerable effects on legal professionals, particularly those working in cybersecurity and data protection.
The amendments to the New York DFS cybersecurity regulations are a reminder of the dynamic and increasingly complex regulatory landscape surrounding data protection and cybersecurity. Legal professionals can anticipate more frequent and comprehensive changes in this area as regulators respond to the rapidly evolving world of cyber threats and privacy concerns. The implementation of appropriate compliant measures to these evolving regulations will continue to be a key focus for organisations and legal advisors across the globe.