New cybersecurity requirements fast approaching for New York financial firms

Many financial firms have mere days to notify New York about whether they have complied with the state’s strict cybersecurity regulations, and to gear up for new requirements rolling out May 1 and beyond.

Annually by April 15, financial businesses must submit a Certification of Material Compliance or an Acknowledgment of Noncompliance, which specifies what still needs to be done. Companies with limited exemptions must submit the notification by April 15 but those with full exemptions do not need to contact NYDFS, the department said.

Additional requirements adopted under the 2023 amendments are rolling out this year, with the first set to hit May 1, focused on secure data access. By that date, all businesses covered by the cyber rules must have policies in place that limit user access to accounts, they must disable or make secure all protocols regarding remote control of devices, and they must take other measures to secure account access.