The state of New York’s Department of Financial Services has identified several areas of heightened cybersecurity risk as a result of the COVID-19 crisis, such as remote working, increased phishing and fraud, and third-party risk. As called for by DFS’s cybersecurity regulation, 23 NYCRR Part 500, regulated entities should assess these risks and address them appropriately.
They also remind all regulated entities that, under 23 NYCRR Section 500.17(a), covered Cybersecurity Events must be reported to DFS as promptly as possible and within 72 hours at the latest. Prompt reporting will enable DFS to respond quickly to new threats as DFS works to protect consumers and the financial services industry in these difficult times.