Is a securities firm, in New York

23 NYCRR 500.11 · Read the law's page

• It reaches you if you operate as a Covered Entity under 23 NYCRR 500.1(e): any person operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law, regardless of whether you are also regulated by other government agencies (reached by declaring that you provide financial services). The limited exemption in section 500.19(a) and the exemptions in section 500.19(c) and (d) do not lift this duty; only the exemptions in section 500.19(b), (e) and (g), which exempt their named classes from the whole Part, do.
• Implement written policies and procedures, based on your risk assessment, designed to ensure the security of information systems and nonpublic information that are accessible to, or held by, third-party service providers (persons who are not your affiliates or governmental entities, provide services to you, and maintain, process or are permitted access to your nonpublic information through those services).
• Address in those policies, to the extent applicable: the identification and risk assessment of third-party service providers; the minimum cybersecurity practices they must meet to do business with you; the due diligence you use to evaluate the adequacy of their cybersecurity practices; and periodic assessment of them based on the risk they present and the continued adequacy of their practices.
• Include in those policies relevant guidelines for due diligence or contractual protections, addressing to the extent applicable each provider's access controls (including its use of multi-factor authentication), its use of encryption to protect nonpublic information in transit and at rest, notice to you of a cybersecurity event directly impacting your information systems or your nonpublic information the provider holds, and representations and warranties about its cybersecurity policies and procedures.

23 NYCRR 500.12 · Read the law's page

• It reaches you if you operate as a Covered Entity under 23 NYCRR 500.1(e): any person operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law, regardless of whether you are also regulated by other government agencies (reached by declaring that you provide financial services). Section 500.19(c) lifts section 500.12 for a covered entity that operates no information systems and holds no nonpublic information, and section 500.19(d) lifts section 500.12 for an article 70 insurer under the Insurance Law that holds no nonpublic information beyond information relating to its corporate parent or affiliates. A covered entity that qualifies for the limited exemption in section 500.19(a) owes the narrower duty in the third line below.
• Use multi-factor authentication, verification of at least two of three types of authentication factor (knowledge, possession and inherence), for any individual accessing any of your information systems.
• If you qualify for the limited exemption in section 500.19(a), use multi-factor authentication for remote access to your information systems, remote access to third-party applications (including cloud-based ones) from which nonpublic information is accessible, and all privileged accounts other than service accounts that prohibit interactive login.
• If you have a Chief Information Security Officer and rely on compensating controls in place of multi-factor authentication, have that officer approve in writing the use of reasonably equivalent or more secure compensating controls, and review those controls periodically and at least annually.

23 NYCRR 500.14(a)(1), (a)(3) · Read the law's page

• It reaches you if you operate as a Covered Entity under 23 NYCRR 500.1(e): any person operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law, regardless of whether you are also regulated by other government agencies (reached by declaring that you provide financial services). The limited exemption in section 500.19(a) lifts the monitoring duty in the second line below, for a covered entity with fewer than 20 employees and independent contractors of the covered entity and its affiliates, less than $7,500,000 in gross annual revenue in each of the last three fiscal years, or less than $15,000,000 in year-end total assets, each counted as section 500.19(a) provides, but does not lift the training duty in the third line. Section 500.19(c) lifts section 500.14 for a covered entity that operates no information systems and holds no nonpublic information, and section 500.19(d) lifts section 500.14 for an article 70 insurer under the Insurance Law that holds no nonpublic information beyond information relating to its corporate parent or affiliates.
• Implement risk-based policies, procedures and controls designed to monitor the activity of authorized users (any employee, contractor, agent or other person that participates in your business operations and is authorized to access and use your information systems and data) and to detect unauthorized access or use of, or tampering with, nonpublic information by those authorized users.
• Provide cybersecurity awareness training that includes social engineering to all personnel periodically and at least annually, updated to reflect the risks you identified in your risk assessment.

23 NYCRR 500.14(a)(2), (b) · Read the law's page

• It reaches you if you operate as a Covered Entity under 23 NYCRR 500.1(e): any person operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law, regardless of whether you are also regulated by other government agencies (reached by declaring that you provide financial services). The limited exemption in section 500.19(a) lifts these duties for a covered entity with fewer than 20 employees and independent contractors of the covered entity and its affiliates, less than $7,500,000 in gross annual revenue in each of the last three fiscal years, or less than $15,000,000 in year-end total assets, each counted as section 500.19(a) provides. Section 500.19(c) lifts section 500.14 for a covered entity that operates no information systems and holds no nonpublic information, and section 500.19(d) lifts section 500.14 for an article 70 insurer under the Insurance Law that holds no nonpublic information beyond information relating to its corporate parent or affiliates.
• Implement risk-based controls designed to protect against malicious code, including controls that monitor and filter web traffic and electronic mail to block malicious content.
• If you are a Class A company as 23 NYCRR 500.1(d) defines it, implement an endpoint detection and response solution to monitor anomalous activity, including lateral movement, and a solution that centralizes logging and security event alerting, unless your Chief Information Security Officer has approved in writing the use of reasonably equivalent or more secure compensating controls.

23 NYCRR 500.15 · Read the law's page

• It reaches you if you operate as a Covered Entity under 23 NYCRR 500.1(e): any person operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law, regardless of whether you are also regulated by other government agencies (reached by declaring that you provide financial services). The limited exemption in section 500.19(a) lifts this duty for a covered entity with fewer than 20 employees and independent contractors of the covered entity and its affiliates, less than $7,500,000 in gross annual revenue in each of the last three fiscal years, or less than $15,000,000 in year-end total assets, each counted as section 500.19(a) provides. Section 500.19(c) lifts section 500.15 for a covered entity that operates no information systems and holds no nonpublic information, and section 500.19(d) lifts section 500.15 for an article 70 insurer under the Insurance Law that holds no nonpublic information beyond information relating to its corporate parent or affiliates.
• Implement a written policy requiring encryption that meets industry standards, to protect the nonpublic information you hold or transmit both in transit over external networks and at rest.
• If you determine that encrypting nonpublic information at rest is infeasible, secure it instead with effective alternative compensating controls that your Chief Information Security Officer has reviewed and approved in writing, and have that officer review the feasibility of encryption and the effectiveness of the compensating controls at least annually.

23 NYCRR 500.16 · Read the law's page

• It reaches you if you operate as a Covered Entity under 23 NYCRR 500.1(e): any person operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law, regardless of whether you are also regulated by other government agencies (reached by declaring that you provide financial services). The limited exemption in section 500.19(a) lifts these duties for a covered entity with fewer than 20 employees and independent contractors of the covered entity and its affiliates, less than $7,500,000 in gross annual revenue in each of the last three fiscal years, or less than $15,000,000 in year-end total assets, each counted as section 500.19(a) provides. Section 500.19(c) lifts section 500.16 for a covered entity that operates no information systems and holds no nonpublic information, and section 500.19(d) lifts section 500.16 for an article 70 insurer under the Insurance Law that holds no nonpublic information beyond information relating to its corporate parent or affiliates.
• Establish written plans, as part of your cybersecurity program, that contain proactive measures to investigate and mitigate cybersecurity events and to ensure operational resilience, including incident response, business continuity and disaster recovery plans.
• Design the incident response plan to enable prompt response to, and recovery from, any cybersecurity event materially affecting the confidentiality, integrity or availability of your information systems or the continuing functionality of any aspect of your business or operations, and address in it, for different types of events including ransomware: its goals; internal response processes; roles, responsibilities and levels of decision-making authority; external and internal communications and information sharing; remediation of identified weaknesses; documentation and reporting; recovery from backups; root cause analysis; and updating of the plan.
• Design the business continuity and disaster recovery plan to ensure the availability and functionality of your information systems and material services and to protect your personnel, assets and nonpublic information during a cybersecurity-related disruption, and include at minimum: the documents, data, facilities, infrastructure, services, personnel and competencies essential to continued operations; the supervisory personnel responsible for each aspect of the plan; a plan to communicate with essential persons during a disruption; procedures for timely recovery of critical data and information systems and resumption of operations; procedures for backing up essential information with sufficient frequency and storing it offsite; and the third parties necessary to the continued operations of your information systems.
• Ensure that current copies of the plans, or the relevant portions, are distributed or otherwise accessible, including during a cybersecurity event, to all employees necessary to implement them, and provide relevant training on their roles and responsibilities to all employees responsible for implementing them.
• Test your incident response and business continuity and disaster recovery plans with all staff and management critical to the response, and your ability to restore critical data and information systems from backups, periodically and at least annually, and revise the plans as necessary.
• Maintain backups necessary to restore material operations, and protect them adequately from unauthorized alterations or destruction.

23 NYCRR 500.17 · Read the law's page

• Notify the Superintendent electronically, in the form set forth on the Department's website, as promptly as possible but no later than 72 hours after you determine that a Cybersecurity Incident has occurred at your organization, an affiliate, or a third-party service provider: an event that requires notice to a government or supervisory body, that has a reasonable likelihood of materially harming a material part of your normal operations, or that results in the deployment of ransomware within a material part of your information systems.when it serves a financial business
• Promptly provide the Superintendent any information requested about a reported incident, and continue updating the Superintendent with material changes or new information previously unavailable; the regulation states no separate numbered clock for either duty.when it serves a financial business
• Where you make an extortion payment in connection with a cybersecurity event, notify the Superintendent of the payment within 24 hours of making it, and within 30 days of the payment provide a written description of why the payment was necessary, the alternatives you considered, and the diligence you performed, including under Office of Foreign Assets Control rules.when it serves a financial business
• By April 15 of each year, submit to the Superintendent electronically either a written certification that you materially complied with this Part for the prior calendar year or a written acknowledgment identifying the sections you did not materially comply with and a remediation timeline, each signed by your highest-ranking executive and your Chief Information Security Officer.when it serves a financial business
• This duty reaches your organization only if it is a Covered Entity under 23 NYCRR 500.1(e): any person operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law, or the Financial Services Law, regardless of whether it is also regulated by another agency. Declare provides_financial_services where that status holds; the limited exemptions in 500.19 do not reach this section, so a small or otherwise exempt covered entity owes the Superintendent-notice duty in full.

23 NYCRR 500.2, 500.3 · Read the law's page

• It reaches you if you operate as a Covered Entity under 23 NYCRR 500.1(e): any person operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law, regardless of whether you are also regulated by other government agencies (reached by declaring that you provide financial services). Section 500.19(c) lifts sections 500.2 and 500.3 for a covered entity that operates no information systems and holds no nonpublic information, and section 500.19(d) lifts sections 500.2 and 500.3 for an article 70 insurer under the Insurance Law that holds no nonpublic information beyond information relating to its corporate parent or affiliates. The limited exemption in section 500.19(a) for smaller covered entities does not lift either section.
• Maintain a cybersecurity program, based on your risk assessment, designed to protect the confidentiality, integrity and availability of your information systems and the nonpublic information stored on them, and designed to identify and assess risks, protect against unauthorized access, detect cybersecurity events, respond to and recover from them, and fulfill applicable regulatory reporting obligations.
• Make all documentation and information relevant to your cybersecurity program, including any provisions you adopt from an affiliate's program, available to the Superintendent on request.
• If you are a Class A company as 23 NYCRR 500.1(d) defines it, design and conduct independent audits of your cybersecurity program based on your risk assessment.
• Implement and maintain a written cybersecurity policy or policies for the protection of your information systems and the nonpublic information stored on them, approved at least annually by a senior officer or your senior governing body, and develop, document and implement procedures in accordance with the policy.
• Base the policy and procedures on your risk assessment and address, at a minimum and to the extent applicable to your operations: information security; data governance, classification and retention; asset inventory, device management and end of life management; access controls, including remote access and identity management; business continuity and disaster recovery planning and resources; systems operations and availability concerns; systems and network security and monitoring; security awareness and training; systems and application security and development and quality assurance; physical security and environmental controls; customer data privacy; vendor and third-party service provider management; risk assessment; incident response and notification; and vulnerability management.

23 NYCRR 500.7 · Read the law's page

• It reaches you if you operate as a Covered Entity under 23 NYCRR 500.1(e): any person operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law, regardless of whether you are also regulated by other government agencies (reached by declaring that you provide financial services). Section 500.19(c) lifts section 500.7 for a covered entity that operates no information systems and holds no nonpublic information, and section 500.19(d) lifts section 500.7 for an article 70 insurer under the Insurance Law that holds no nonpublic information beyond information relating to its corporate parent or affiliates. The limited exemption in section 500.19(a) for smaller covered entities does not lift it.
• Based on your risk assessment, limit user access privileges on information systems that provide access to nonpublic information to only those necessary to perform the user's job, limit the number of privileged accounts and their access functions to only those necessary to perform the user's job, and use a privileged account only when performing functions that require that access.
• Review all user access privileges periodically and at least annually, and remove or disable accounts and access that are no longer necessary; promptly terminate access following departures.
• Disable or securely configure all protocols that permit remote control of devices.
• If you use passwords as a method of authentication, implement a written password policy that meets industry standards.
• If you are a Class A company as 23 NYCRR 500.1(d) defines it, monitor privileged access activity and implement a privileged access management solution and an automated method of blocking commonly used passwords for all accounts on information systems you own or control and, wherever feasible, for all other accounts; where you determine that blocking is infeasible, your Chief Information Security Officer may instead approve in writing, at least annually, the infeasibility and the use of reasonably equivalent or more secure compensating controls.