Nation’s First Law for Cyber Security Programs

New York state has adopted a regulation that requires financial institutions, including insurers, to establish a cyber security program.

The rule requires regulated companies to implement controls to ensure a robust cyber security program, including requirements for a program that is adequately funded and staffed, overseen by qualified management and reported on periodically to the most senior governing body of the organization.

The regulation also adopts risk-based minimum standards for technology systems. It establishes required minimum standards to help address any cyber breaches such as an incident response plan, preservation of data to respond to such breaches, and notice to the state of material events.

“New York is the financial capital of the world, and it is critical that we do everything in our power to protect consumers and our financial system from the ever-increasing threat of cyber-attacks,” said Gov. Andrew Cuomo. “These strong, first-in-the-nation protections will help ensure this industry has the necessary safeguards in place in order to protect themselves and the New Yorkers they serve from the serious economic harm caused by these devastating cyber crimes.”

Source: Business Insurance