{"publisher":"NovaCopilot","source":{"name":"New York State Senate Open Legislation","url":"https://www.dfs.ny.gov/system/files/documents/2023/12/rf23_nycrr_part_500_amend02_20231101.pdf"},"license":"https://legal.exploreworldai.com/revision","id":"us-new-york:nydfs-incident-notice","jurisdiction":"United States","state":"New York","level":"state","question":"When must an NYDFS covered entity report a cybersecurity incident?","answer":"It must notify the Superintendent electronically as promptly as possible but no later than 72 hours after determining that a reportable cybersecurity incident occurred.","reference":"23 NYCRR § 500.17(a)","authority":"New York State Department of Financial Services","legalKind":"regulation","status":"In force at the reading date","readAt":"2026-09-22","relatedRules":[],"relatedCases":[],"canonical":"https://legal.exploreworldai.com/us/new-york/questions/nydfs-incident-notice","version":"us-new-york-v1.0.0","hash":"sha256:4cfff1df2221c8341f17777219a067c20a5d136519cd68bbc70efcf8adf74f4c"}