NYDFS Finalizes More Granular Cybersecurity Requirements

Caleb Skeath’s commentary was included in a Global Data Review article covering the finalization of new cybersecurity standards by the New York State Department of Financial Services. The new provisions include mandating the use of multi-factor authentication and requiring companies to track their technology assets.

Insurance carriers, state and federal laws and contracts have long required multi-factor authorization, but Caleb observed that the NYDFS’s requirements set a new standard. “I don’t know if it’s necessarily a higher bar, but it may limit entities' flexibility with regard to how they approach [matters] in cybersecurity and how they implement cybersecurity controls,” he said. “A lot of the [other] legal requirements are focused on reasonable cybersecurity, which affords entities with a lot of flexibility.”