New York has launched an inquiry into the steps that insurers are taking to keep their customers and companies safe from cyber threats.
The New York State Department of Financial Services (“DFS”) has sent “308 Letters” to the largest insurance companies that DFS regulates, requesting information on the policies and procedures they have in place to protect against cyber attacks. A “308 letter” is a request for information to which insurers are legally required to respond.
“The extraordinarily sensitive health, personal, and financial information that New Yorkers entrust to their insurance companies is a virtual treasure trove for hackers,” said New York Governor Andrew Cuomo.
Benjamin M. Lawsky, Superintendent of Financial Services and co-chair of the Governor's Cyber Security Advisory Board, added, “Cyber security at insurance companies is something that often gets overlooked, but it's far too important to get caught in a blind spot. We need to make sure that those insurance records are protected from hack attacks that could put New Yorkers at risk.”
The 308 letters that DFS sent to insurers requested a wide variety of information as part of the DFS' inquiry, including:
- Information on any cyber attacks the company has been subject to in the past three years;
- The cyber security safeguards the company has put in place;
- The company's information technology management policies;
- The amount of funds and other resources dedicated to cyber security at the company; and
- The company's governance and internal control policies related to cyber security.
Earlier this year, DFS sent similar inquiries to the largest banks that it regulates, requesting information on their cyber security policies.
Governor Cuomo outlined the Cyber Security Advisory Board, which is charged with advising the administration on developments in cyber security and making recommendations for protecting the state's critical infrastructure and information systems, in an address in January.
Earlier this month, the governor named the following people to the board: Richard Clarke, chairman and chief executive officer at Good Harbor Consulting, LLC, and former White House counter-terrorism and cyber security advisor; Shawn Henry, president of CrowdStrike Services; Will Pelgrin, president and chief executive officer of the Center for Internet Security and the founder of the Multi-State Information Sharing and Analysis Center; Phil Reitinger, senior vice president and chief information security officer at Sony Corporation; and Howard Schmidt, former White House cyber security coordinator and special assistant to President Obama. The advisory board is co-chaired by Deputy Secretary to the Governor for Public Safety Elizabeth Glazer and Superintendent Lawsky.
The insurance companies that received 308 letters from DFS include:
|
|