Share:
Critics of New York’s proposed cybersecurity regulations for the financial and insurance sectors say the proposal is too restrictive and will be difficult to implement, especially for small institutions. The proposed regulations are far more prescriptive than guidance issued by the Federal Financial Institutions Examination Council, which has focused on recommending best practices instead of requiring specific compliance actions. Critics also say the 72-hour breach notification deadline is unrealistic and that the role of chief information security officer—which institutions would be required to fill should the regulations be adopted—is poorly defined and unlikely to do much to improve a firm’s cybersecurity.
Share:
