Law / United States / 
New York
New York Department of Financial Services Cybersecurity Regulation, Notices to the Superintendent
In force.
A vulnerability and incident reporting rule binding private bodies.
- Criminal exposure
- No
- Enforcement body
- The Superintendent of Financial Services.
- Obligation class
- Reporting, Security
What it requires
- This duty reaches your organization only if it is a Covered Entity under 23 NYCRR 500.1(e): any person operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law, or the Financial Services Law, regardless of whether it is also regulated by another agency. Declare provides_financial_services where that status holds; the limited exemptions in 500.19 do not reach this section, so a small or otherwise exempt covered entity owes the Superintendent-notice duty in full.
- Notify the Superintendent electronically, in the form set forth on the Department's website, as promptly as possible but no later than 72 hours after you determine that a Cybersecurity Incident has occurred at your organization, an affiliate, or a third-party service provider: an event that requires notice to a government or supervisory body, that has a reasonable likelihood of materially harming a material part of your normal operations, or that results in the deployment of ransomware within a material part of your information systems.NIST CSF 2.0RS.CO-02
- Promptly provide the Superintendent any information requested about a reported incident, and continue updating the Superintendent with material changes or new information previously unavailable; the regulation states no separate numbered clock for either duty.NIST CSF 2.0RS.CO-03
- Where you make an extortion payment in connection with a cybersecurity event, notify the Superintendent of the payment within 24 hours of making it, and within 30 days of the payment provide a written description of why the payment was necessary, the alternatives you considered, and the diligence you performed, including under Office of Foreign Assets Control rules.NIST CSF 2.0RS.CO-02NIST CSF 2.0RS.CO-03
- By April 15 of each year, submit to the Superintendent electronically either a written certification that you materially complied with this Part for the prior calendar year or a written acknowledgment identifying the sections you did not materially comply with and a remediation timeline, each signed by your highest-ranking executive and your Chief Information Security Officer.NIST CSF 2.0ID.IM-01NIST CSF 2.0GV.RR-01
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- ID.IM-01Improvements are identified from evaluations
- RS.CO-02Internal and external stakeholders are notified of incidents
- RS.CO-03Information is shared with designated internal and external stakeholders
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
What this law does
Section 500.17 of 23 NYCRR Part 500 requires a Covered Entity to notify the Superintendent of Financial Services electronically as promptly as possible but no later than 72 hours after determining that a Cybersecurity Incident has occurred at the covered entity, its affiliates, or a third-party service provider.
A Cybersecurity Incident is a Cybersecurity Event, a broader term covering any attempt to gain unauthorized access to or misuse an information system, that also either requires notice to a government or supervisory body, carries a reasonable likelihood of materially harming a material part of normal operations, or results in the deployment of ransomware within a material part of the covered entity's information systems.
Each covered entity must promptly provide the Superintendent with any information the Superintendent requests about a reported incident and must continue updating the Superintendent with material changes or new information, with no separate numbered clock on either duty.
Where a covered entity makes an extortion payment in connection with a cybersecurity event, it must notify the Superintendent of the payment within 24 hours of making it and, within 30 days of the payment, provide a written description of why the payment was necessary and what alternatives and compliance diligence it performed.
By April 15 each year, a covered entity must submit either a written certification that it materially complied with this Part for the prior calendar year or a written acknowledgment identifying the sections it did not materially comply with and a remediation timeline, signed by its highest-ranking executive and its Chief Information Security Officer.
The limited exemptions in 23 NYCRR 500.19(a), (c) and (d), covering a small covered entity and an entity without its own information systems or nonpublic information, each work by naming the sections they relieve, and none of them names section 500.17, so an entity holding one of those still owes the Superintendent-notice duty in full.
Subsections 500.19(b), (e) and (g) work the other way, exempting their named classes from the requirements of the whole Part, which carries section 500.17 with it.
Section 500.11 requires a covered entity to adopt its own policies and contractual protections for a third-party service provider, including contractual notice to the covered entity of a cybersecurity event, so Part 500 reaches a third-party service provider only through the covered entity's own duties and never binds the provider directly unless the provider independently qualifies as its own covered entity. The provisions this entry describes came into force on different days.
Part 500 took effect on , and its Second Amendment on . Covered entities had 30 days from the Second Amendment's effective date to comply with this section's new requirements.
When LexLint raises it
When your app profile says your app provides financial services.
Back to the example · Lint your app
Page updated .