In addition to risk assessments, the regulations mandate that financial institutions maintain a cybersecurity program designed to protect their systems, networks, and customer data. This program should include policies, procedures, and controls to safeguard sensitive information and ensure the integrity of financial transactions. These measures are crucial for building resilience against cyberattacks and minimizing the impact of security incidents.

Furthermore, the NYDFS regulations require financial institutions to establish an incident response plan. This plan should outline the steps to be taken in the event of a cybersecurity incident, with an emphasis on swift and effective response to mitigate any damage. The ability to respond promptly to incidents, whether they involve data breaches or network disruptions, is critical in limiting the potential harm to customers and the organization itself.

Another noteworthy aspect of the regulations is the focus on third-party cybersecurity practices. Financial firms often rely on third-party service providers for various aspects of their operations. The new rules require firms to assess the cybersecurity policies and practices of these third parties, ensuring that they meet the necessary security standards to protect sensitive data.

While the primary goal of these regulations is to enhance cybersecurity and protect against cyber threats, non-compliance carries significant consequences. Financial institutions found to be in violation of the regulations may face regulatory sanctions, including hefty fines, as well as damage to their reputation.

The NYDFS has a history of taking a proactive approach to cybersecurity regulations. The agency implemented its first cybersecurity regulations in 2017, which represented a pioneering effort to set cybersecurity standards for financial institutions. These regulations served as a model for other states and even had a nationwide impact.