The NYDFS said that it believes that it would be “beneficial to coordinate its efforts with relevant state and federal agencies to develop a comprehensive cyber security framework that addresses the most critical issues, while still preserving the flexibility to address New York-specific concerns.”

It said that it expects that its potential regulations would require covered entities to implement and maintain written cyber security policies and procedures that address the following areas:

(1) information security;

(2) data governance and classification;

(3) access controls and identity management;

(4) business continuity and disaster recovery planning and resources;

(5) capacity and performance planning;

(6) systems operations and availability concerns;

(7) systems and network security;

(8) systems and application development and quality assurance;

(9) physical security and environmental controls;

(10) customer data privacy;

(11) vendor and third-party service provider management; and

(12) incident response, including by setting clearly defined roles and decision making authority.

In addition, it said, there would be requirements for minimum preferred terms to be included in contracts with third-party service providers, including provisions requiring:

(1) the use of multi-factor authentication to limit access to sensitive data and systems;

(2) the use of encryption to protect sensitive data in transit and at rest;

(3) notice to be provided in the event of a cyber security incident;

(4) the indemnification of the entity in the event of a cyber security incident that results in loss;

(5) the ability of the entity or its agents to perform cyber security audits of the third party vendor; and

(6) representations and warranties by the third party vendors concerning information security.

Moreover, the NYDFS said that any regulation that establishes cyber security program requirements for covered entities also should address the use of multi-factor authentication as it applies to:

(1) customer access to web applications that captures or displays confidential information;

(2) privileged access to database servers that allow access to confidential information; and

(3) any access to internal systems or data from an external network.

To this end, it said, covered entities would be required, among other things, to implement multi-factor authentication for all access to internal systems and data from an external network.

In the opinion of the NYDFS, each covered entity would be required to designate a qualified employee to serve as its Chief Information Security Officer (“CISO”) responsible for overseeing and implementing its cyber security program and enforcing its cyber security policy. The CISO also would be required to submit to the NYDFS an annual report, reviewed by the entity's board, assessing the cyber security program and the cyber security risks to the entity.

Covered entities also would be required to maintain an audit trail system that:

(1) logs privileged user access to critical systems;

(2) protects log data stored as part of the audit trail from alteration or tampering;

(3) protects the integrity of hardware from alteration or tampering; and

(4) logs system events, including access and alterations made to audit trail systems.

Each covered entity also would be required to immediately notify the NYDFS of any cyber security incident that has a “reasonable likelihood of materially affecting the normal operation of the entity,” including any cyber security incident:

(1) that triggers certain other notice provisions under New York Law;

(2) of which the entity's board is notified; or

(3) that involves the compromise of “nonpublic personal health information” and “private information” as defined under New York Law, payment card information or any biometric data.

Learn more: http://www.dfs.ny.gov/about/letters/pr151109_letter_cyber_security.pdf.