Notice of a cybersecurity event

Utfall som hviler på seksjonen

Reglene nedenfor viser til denne seksjonen i utfallet sitt. Verdiktet er en maskinell klassifisering, ikke en vurdering av en enkelt sak.

• nydfs-incident

  Notice of the cybersecurity event is late

  23 NYCRR 500.17(a) requires notice to the supervisor as promptly as possible and no later than 72 hours after determining that the event is notifiable. 23 NYCRR 500.17(b) requires an annual certification.

  forbudt, Kravet gjelder

• nydfs-exempt

  A limited exemption applies, the core requirements remain

  23 NYCRR 500.19 exempts certain smaller entities from parts of the regulation. The exemption does not cover the program and policy in 500.2 and 500.3, the risk assessment in 500.9 or the notice in 500.17.

  risiko, Kravet gjelder betinget

• nydfs-base

  The regulation applies to the business

  23 NYCRR Part 500 applies to every entity licensed under New York banking, insurance or financial services law. The requirements cover the program, the responsible function, authentication and notice.

  risiko, Kravet gjelder

Seksjonsnoder

• Cybersecurity program and policy23 NYCRR 500.2 and 500.3
• Chief Information Security Officer23 NYCRR 500.4
• Multi-factor authentication23 NYCRR 500.12