Cybersecurity program and policy

Ergebnisse, die auf diesem Abschnitt ruhen

Die Regeln unten verweisen in ihrem Ergebnis auf diesen Abschnitt. Das Verdikt ist eine maschinelle Einordnung, kein Urteil über einen Einzelfall.

• nydfs-exempt

  A limited exemption applies, the core requirements remain

  23 NYCRR 500.19 exempts certain smaller entities from parts of the regulation. The exemption does not cover the program and policy in 500.2 and 500.3, the risk assessment in 500.9 or the notice in 500.17.

  Risiko, Die Anforderung gilt bedingt

• nydfs-program

  A documented program and an approved policy are absent

  23 NYCRR 500.2 requires a documented cybersecurity program based on the risk assessment, and 23 NYCRR 500.3 requires a written policy approved by the board or a senior officer.

  unzulässig, Die Anforderung gilt

• nydfs-risk

  The risk assessment or the supplier policy is absent

  23 NYCRR 500.9 requires a current and documented risk assessment, and 23 NYCRR 500.11 requires a third party service provider policy with contractual requirements.

  Risiko, Die Anforderung gilt bedingt

• nydfs-base

  The regulation applies to the business

  23 NYCRR Part 500 applies to every entity licensed under New York banking, insurance or financial services law. The requirements cover the program, the responsible function, authentication and notice.

  Risiko, Die Anforderung gilt

Abschnittsknoten

• Chief Information Security Officer23 NYCRR 500.4
• Multi-factor authentication23 NYCRR 500.12
• Notice of a cybersecurity event23 NYCRR 500.17