ALBANY, N.Y.—The next deadline associated with New York’s first-in-the-nation set of cybersecurity compliance regulations arrives next week. The new rules went into effect in March 2017 and effect any business or organization that reports to the Department of Financial Services.
A number of checkpoints have already been passed since the regulations took effect, requiring businesses to implement varying levels of cybersecurity initiatives and protocols. By Feb. 15, those organizations will need to verify their efforts by submitting their first annual certification of compliance, WestFairOnline.com reported.
Credit unions are among the institutions affected by the new rules.
“Already these organizations should have established and be maintaining a cybersecurity program and cybersecurity policy; have designated a qualified individual, internal or outsourced, to serve as chief information security officer (CISO); be limiting user-access privileges as part of the cybersecurity program; be utilizing qualified cybersecurity personnel; have established a written incident-response plan; have notified the DFS of cybersecurity events as required, and have filed a notice of exemption, if applicable,” WestFairOnline.com explained, adding that affected businesses not in compliance with these requirements will face heavy fines.
Immediately following that deadline, CISOs are required to deliver an annual report to the board or governing body of the company by March 1. Companies subject to the full regulations must also begin conducting annual penetration testing, biannual vulnerability assessments and periodic risk assessments, as well as establish multifactor authentication, if needed, and provide regular cybersecurity awareness training for all personnel. Additional transitional time periods will end on Sept. 3 and March 1, 2019, WestFairOnline.com noted.