The NYS DFS (New York State Department of Financial Services), declared 23 New York Code Rules and Regulations 500 (23 NYCRR 500), a cybersecurity regulation for financial service organizations doing business in New York state. All banks, financial organizations and identical businesses must comprehend their accountabilities under 23 NYCRR 500, especially for strong authentication & securing data.

Listed below are the requirements 23 NYCRR 500 places on financial institution operating in the state of NY.

Prepare policies & procedures for safeguarding information systems:
There should be a standard written guideline with procedures in place to safeguard information system, consumer data, and other nonpublic minutiae. The guideline must be based on a comprehensive & stout risk evaluation.

Hire a CISO:
All financial institutions must appoint a Chief Information Security Officer who is accountable for supervising & executing a cybersecurity program that safeguards systems & data.

Conduct Penetration Testing & Vulnerability Assessments:
Financial services institutions should continuously screen & assess the security of their business systems & data. This must be based on a risk assessment & can be conducted via penetration testing, vulnerability scanning, and identical approaches.

Make sure financial services have audit trails:
All financial transactions must have an auditable history, including audit trails intended to identify & respond to cybersecurity concerns that may damage business systems, operations, or data.

Conduct regular cybersecurity risk assessments:
All financial services institutions must regularly conduct risk appraisals of their cybersecurity and make plan of action to identify any vulnerabilities, gaps, or deficits.

Dispose of expired data in a safe way:
A financial services organization should make sure that any nonpublic info no longer needed is disposed of safely.

Train & screen personnel:
Institutions must screen the activity of users when they access business systems & non-public info, and offer regular cybersecurity awareness training for all employees.

Execute an incident response plan for cybersecurity breaches & issues:
The institution should execute a comprehensive & stout incident response plan intended to respond timely to, and recover from, and cybersecurity problems that impacts the integrity of business systems or sensitive info.

If you have any further queries regarding NYCRR 500 compliance, feel free to get in touch with CompCiti. CompCiti will not just make sure that you’re compliant, but will help you in implementing a more efficient, long-term cyber security protocol in the process.

Disclaimer:
This content is created and provided by a third-party online content writer on behalf of CompCiti, and is for commercial purposes only. CompCiti does not take any responsibility on the accuracy of this article.

Source: https://23nycrrpart500.wordpress.com/2020/09/25/what-the-ny-dfs-cybersecurity-regulations-mandate/